Splunk Search

After I have changed the name of a host, how can I show two host names as one name?

Explorer

I fixed the name of a host on the forwarder. It was showing as "hostname.domain.com" instead of just "hostname". I fixed the name and restarted the Splunk service.

Now i have 2 different host names showing in Splunk up for the same host. How could i show all of the "hostname.domain.com" data as "hostname" also?

0 Karma
1 Solution

Legend

At first, verify in the a period after you changed hostname because old events aren't affected by the change.
In addition, where you fixed hostname? you had to do this in two points:

  • $SPLUNK_HOME/etc/system/local/server.conf
  • $SPLUNK_HOME/etc/system/local/inputs.conf

Bye.
Giuseppe

View solution in original post

Legend

At first, verify in the a period after you changed hostname because old events aren't affected by the change.
In addition, where you fixed hostname? you had to do this in two points:

  • $SPLUNK_HOME/etc/system/local/server.conf
  • $SPLUNK_HOME/etc/system/local/inputs.conf

Bye.
Giuseppe

View solution in original post

Explorer

i didn't update the server.conf. After i did that and restarted the forwarder the indexer picked it up and all of the old data is searchable by "hostname" now. Thanks

0 Karma

Legend

Try this

... | rex field=host "^(?<host>\w+)" | ...
0 Karma

Motivator

tag or an alias is the easiest but if you want to do it in a search then try this

{search}|eval host=if(host=hostname.domain.com,{corrected hostname},host)

0 Karma

Super Champion

try creating a tag or alias? it won't change the raw data, but it'll help you search the data easier?

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Abouttagsandaliases

0 Karma

SplunkTrust
SplunkTrust

After making the changes, it will not change the hostname retroactively, so anything indexed before making the changes will remain the same. If you don't like this, you can remove the data and reindex it with your updated hostname

0 Karma