Splunk Search
Highlighted

How is this field generated...

Path Finder

... "src_hostname"?

The reason I ask, is that I can not seem to find it, and it is generating "odd" results in a search someone set up for us an age ago.

Thanks,

Matt

Tags (2)
0 Karma
Highlighted

Re: How is this field generated...

Builder

I dont think that is a Splunk default field. On the search head go to the manager and then to fields > field extractions and then search for src_hostname (make sure you set the app context pulldown menu and the user pulldown to All). that should list the regex that is being used to generate that field.

View solution in original post

Highlighted

Re: How is this field generated...

Path Finder

Stupid mistake on my behalf... it was a really long search, at the end of a really long day, and missed the lookup.

HAHAHAHAHHAHAHAH

0 Karma
Highlighted

Re: How is this field generated...

SplunkTrust
SplunkTrust

In case you're calling it a field but it is actually a sourcetype , you'll have to check the inputs.conf files you have deployed.

If it is indeed a field, the answer from cramasta below is acceptable.

0 Karma