strip fqdn from hostname field

[hanijamal]

hey guys, i am pretty sure we have something in place which is stripping the hostname from the fqdn. just cannot figure it out.

for example host=ab12345.domain.com gets stripped and when searched only shows host=ab12345

we have a few thousand hosts that are coming in fine, however a handful show up WITH fqdn when i make a search.

why would only a few hosts be showing with fqdn when 99% are showing in search fine.

background: we have a host data coming in from ucmd via lookup

thanks

[inventsekar]

for logs which are not yet indexed, you can use props and transform, as mentioned above.

for the data which is already indexed, you can use regular expressions to pick only the hostnames

your search | rex field=_raw "host=(?<hostname>\w+)\." | table _raw hostname

[gcusello · Accepted solution]

Hi hanijamal,
I don't know if you can intervene on your forwarders, but the hostname is setted in two conf files sited in $SPLUNK_HOME/etc/system/local:

• output.conf
• inputs.conf Your should verify what is the hostname you receive.

If you cannot modify hostname in your forwarders, the only way is to override hosts using props.conf and transforms.conf (see https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Overridedefaulthostassignments#Configuration...

Bye.
Giuseppe

[gokadroid]

transforms.conf and props.conf might be the right place to start with and from. Please have a look here:
https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Overridedefaulthostassignments#Configuration