Splunk Search

How do I rename a hostname in Splunk?

dbashyam
Explorer

Hi, How do I rename hostname in Splunk?

I am trying to enroll a particular syslog in Splunk. I want to rename a hostname from
a => b
c => d

How could I achieve this?

Thanks,
Dinesh

0 Karma
1 Solution

FrankVl
Ultra Champion

It would help if you would provide a bit more concrete info on what you really want to rename rather than such an abstract example, but the basics work like below (assuming you want to rename certain specific host values and not generically want to rename all host values for a certain source/sourcetype).

in props.conf

[host::a]
TRANSFORMS-rename_host = rename_host_a

in transforms.conf

[rename_host_a]
REGEX = .
FORMAT = host::b
DEST_KEY = MetaData:Host

View solution in original post

0 Karma

woodcock
Esteemed Legend

For syslog, this is generally done with host_segment in indexes.conf. You must configure syslog to write the originating host as part of the path to the files.

0 Karma

FrankVl
Ultra Champion

It would help if you would provide a bit more concrete info on what you really want to rename rather than such an abstract example, but the basics work like below (assuming you want to rename certain specific host values and not generically want to rename all host values for a certain source/sourcetype).

in props.conf

[host::a]
TRANSFORMS-rename_host = rename_host_a

in transforms.conf

[rename_host_a]
REGEX = .
FORMAT = host::b
DEST_KEY = MetaData:Host
0 Karma

dbashyam
Explorer

Thanks Frank, I will check this up and will update you

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...