Getting Data In

how do I change a host when seeing multiple hosts?

micropotato
Engager

I see the same host in my Summary page in Search app with same event count.

They are the same host but show up like: hostname123_xxx.domain.suffix hostname123.domain.suffix

Can I make them both show as just hostname123 going forward?

Tags (1)
1 Solution

bwooden
Splunk Employee
Splunk Employee
0 Karma

bwooden
Splunk Employee
Splunk Employee

Here is a similar thread that discusses how host names are assigned: http://answers.splunk.com/questions/1308/syslog-ng-logs-show-as-hostlocalserver-rather-than-remote

0 Karma
Get Updates on the Splunk Community!

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...