Getting Data In

What is the easiest way to search-time transform for hostname and FQDN?

whar_garbl
Path Finder

I have historical data in Splunk where the same host may appear as either Hostname.Domain.Com or Hostname. I would like all searches that specify Hostname to also gather events for Hostname.Domain.Com without modifying any searches. I can't delete and reindex, so that's right out.

I found this post , which seems to be more or less what I want to do, but it isn't working, and I'm not sure why. It's older, so maybe the settings need to be different. 

What is the easiest way to accomplish this goal? Cheers.

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Transforms are applied at index time.  The solution you're pointing to is rewriting the host value when splunk is ingesting events. It shortens them host field for *.company.com before indexing themevents. With such setup all applicable events would have short names. But only the newly indexed ones of course.

As I understand your indexed field host for some of your already indexed events contains host=host1 and for some host=host1.domain.com.

And you would like to match events with host=host1.domain.com to match if a user searches for just host=host1?

That's a tough one. There is a solution but it's very ugly and I wouldn't do that if I were you - fiddling with default fields can have unforseeable results.

But anyway.

Since you want the host field to match both hostname as well as fqdn, you need to make the field multivalued in search time. To do this you have to define a calculated field named host for your sourcetype (or host) with formula

mvappend(host,mvindex(split(host,"."),0)

Hopelessly ugly hack but seems to work on my lab.

whar_garbl
Path Finder

Thank you for the detailed explanation. I'll try this in test and see how it works with my dataset.

 

I suppose it isn't the end of the world if only newly indexed events have the short name, but I know my security folks will hate that answer. It'll be irritating to go back and edit every dashboard panel deployment-wide to accommodate the two-name dichotomy for historical searches.

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It seems I ate one closing parenthesis ;). But you probably spotted that while testing.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...