After I have changed the name of a host, how can I show two host names as one name?

[jeremeek]

I fixed the name of a host on the forwarder. It was showing as "hostname.domain.com" instead of just "hostname". I fixed the name and restarted the Splunk service.

Now i have 2 different host names showing in Splunk up for the same host. How could i show all of the "hostname.domain.com" data as "hostname" also?

[gcusello · Accepted solution]

At first, verify in the a period after you changed hostname because old events aren't affected by the change.
In addition, where you fixed hostname? you had to do this in two points:

• $SPLUNK_HOME/etc/system/local/server.conf
• $SPLUNK_HOME/etc/system/local/inputs.conf

Bye.
Giuseppe

[jeremeek]

i didn't update the server.conf. After i did that and restarted the forwarder the indexer picked it up and all of the old data is searchable by "hostname" now. Thanks

[sundareshr]

Try this

... | rex field=host "^(?<host>\w+)" | ...

[dbcase]

tag or an alias is the easiest but if you want to do it in a search then try this

{search}|eval host=if(host=hostname.domain.com,{corrected hostname},host)

[cmerriman]

try creating a tag or alias? it won't change the raw data, but it'll help you search the data easier?

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Abouttagsandaliases

[skoelpin]

After making the changes, it will not change the hostname retroactively, so anything indexed before making the changes will remain the same. If you don't like this, you can remove the data and reindex it with your updated hostname