Hi, How do I rename hostname in Splunk?
I am trying to enroll a particular syslog in Splunk. I want to rename a hostname from
a => b
c => d
How could I achieve this?
Thanks,
Dinesh
It would help if you would provide a bit more concrete info on what you really want to rename rather than such an abstract example, but the basics work like below (assuming you want to rename certain specific host values and not generically want to rename all host values for a certain source/sourcetype).
in props.conf
[host::a]
TRANSFORMS-rename_host = rename_host_a
in transforms.conf
[rename_host_a]
REGEX = .
FORMAT = host::b
DEST_KEY = MetaData:Host
For syslog, this is generally done with host_segment
in indexes.conf
. You must configure syslog
to write the originating host as part of the path to the files.
It would help if you would provide a bit more concrete info on what you really want to rename rather than such an abstract example, but the basics work like below (assuming you want to rename certain specific host values and not generically want to rename all host values for a certain source/sourcetype).
in props.conf
[host::a]
TRANSFORMS-rename_host = rename_host_a
in transforms.conf
[rename_host_a]
REGEX = .
FORMAT = host::b
DEST_KEY = MetaData:Host
Thanks Frank, I will check this up and will update you