Getting Data In

how can I keep the original host name in my summary index?


I would like to duplicate a subset of events to another index. Just an exact duplicate of the original event. Summary indexing works great (as does collect) with the exception that I lose the original host and source information. I need the host. Source would be nice. I have not been able to figure out how to get those values in my summary index. I just don't have the knowledge to see the solution. Can someone help me out?

I have spent a few days looking at other Answers but could not find any that just wanted an exact duplicate event. Actually metasearch came close to doing what I wanted but gave me errors having to do with exceeded maxsearches - and was noticeably slow.

I feel like this ought to be a straightforward thing to do but, after a few days trial and error, I am humbled. I greatly appreciate any help. Thank You.

0 Karma


You can use an eval to store the original host value: | eval orig_host=host | collect ...

0 Karma


Thank you dflodstrom! I tried this technique and it sort of worked. I did not get a new field in my summary index named orig_host but the source value WAS updated to the original hostname. It is quite likely I am omitting something. There is so much I don't know about Splunk!

Before adding "eval" source = /opt/splunk/var/spool/splunk/c4f34f0ea0dcaeb2_events.stash_new

After adding "eval" source =

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!