Splunk Search

How is this field generated...

SplunkFu
Path Finder

... "src_hostname"?

The reason I ask, is that I can not seem to find it, and it is generating "odd" results in a search someone set up for us an age ago.

Thanks,

Matt

Tags (2)
0 Karma
1 Solution

cramasta
Builder

I dont think that is a Splunk default field. On the search head go to the manager and then to fields > field extractions and then search for src_hostname (make sure you set the app context pulldown menu and the user pulldown to All). that should list the regex that is being used to generate that field.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

In case you're calling it a field but it is actually a sourcetype , you'll have to check the inputs.conf files you have deployed.

If it is indeed a field, the answer from cramasta below is acceptable.

0 Karma

cramasta
Builder

I dont think that is a Splunk default field. On the search head go to the manager and then to fields > field extractions and then search for src_hostname (make sure you set the app context pulldown menu and the user pulldown to All). that should list the regex that is being used to generate that field.

SplunkFu
Path Finder

Stupid mistake on my behalf... it was a really long search, at the end of a really long day, and missed the lookup.

HAHAHAHAHHAHAHAH

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...