How is this field generated...

[SplunkFu]

... "src_hostname"?

The reason I ask, is that I can not seem to find it, and it is generating "odd" results in a search someone set up for us an age ago.

Thanks,

Matt

[jkat54]

In case you're calling it a field but it is actually a sourcetype , you'll have to check the inputs.conf files you have deployed.

If it is indeed a field, the answer from cramasta below is acceptable.

[cramasta · Accepted solution]

I dont think that is a Splunk default field. On the search head go to the manager and then to fields > field extractions and then search for src_hostname (make sure you set the app context pulldown menu and the user pulldown to All). that should list the regex that is being used to generate that field.

[SplunkFu]

Stupid mistake on my behalf... it was a really long search, at the end of a really long day, and missed the lookup.

HAHAHAHAHHAHAHAH