Getting Data In
Highlighted

how do I change a host when seeing multiple hosts?

Engager

I see the same host in my Summary page in Search app with same event count.

They are the same host but show up like: hostname123_xxx.domain.suffix hostname123.domain.suffix

Can I make them both show as just hostname123 going forward?

Tags (1)
Highlighted

Re: how do I change a host when seeing multiple hosts?

Splunk Employee
Splunk Employee
0 Karma