Splunk Search

Duplicate Host Field from JSON Event

max_weber
Explorer

Hey there,

we are pumping millions of Zabbix events in to our splunk environment over a Heavy Forwarder. The events are JSON string like this:

{"host":"myHostname","groups":["OS_RHEL","OS_RHEL_ES"],"applications":["FS RHELBASIC","Filesystems"],"itemid":1234,"name":"/var/log - used space (total)","clock":1562748008,"ns":583690877,"value":194605056}

the props for this sourcetype looks like this:

props.conf
TIME_PREFIX=\"clock\"\:
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
SHOULD_LINEMERGE=false

At first my problem was that the host field was filled with the hostname of the Heavy Forwarder. For easier use for our users, i want the host from the JSON event in my splunk "host" field. I tried to do that with following transforms:

[set_hostname_zabbix]
REGEX = "host":"(?P<host>[^"]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host

This kind of worked, but now my problem is that i got two host fields both filled with the same data.
Any ideas how I can fix this, so I just get one host field filled with the hostname from the JSON event?

Regards,

Max

0 Karma

woodcock
Esteemed Legend

You have 2 options. You could set KV_MODE = none and because you are using indexed_extractions anyway, this should work fine. You could also set a calculated field like this: eval-host=mvdedup(host).

0 Karma

max_weber
Explorer

thanks for you advice. i have to try this.

but I think the first method won't help, cause the "host" field is a field which is always extracted not depending on the KV_MODE setting.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...