Splunk Search

How is this field generated...

SplunkFu
Path Finder

... "src_hostname"?

The reason I ask, is that I can not seem to find it, and it is generating "odd" results in a search someone set up for us an age ago.

Thanks,

Matt

Tags (2)
0 Karma
1 Solution

cramasta
Builder

I dont think that is a Splunk default field. On the search head go to the manager and then to fields > field extractions and then search for src_hostname (make sure you set the app context pulldown menu and the user pulldown to All). that should list the regex that is being used to generate that field.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

In case you're calling it a field but it is actually a sourcetype , you'll have to check the inputs.conf files you have deployed.

If it is indeed a field, the answer from cramasta below is acceptable.

0 Karma

cramasta
Builder

I dont think that is a Splunk default field. On the search head go to the manager and then to fields > field extractions and then search for src_hostname (make sure you set the app context pulldown menu and the user pulldown to All). that should list the regex that is being used to generate that field.

SplunkFu
Path Finder

Stupid mistake on my behalf... it was a really long search, at the end of a really long day, and missed the lookup.

HAHAHAHAHHAHAHAH

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...