Splunk Search

Override host field value at search time

mihelic
Path Finder

We have some old indexed events that have their host field value set to the name of the forwarder on the central syslog host. It appears, that hostname extraction was not configured correctly at that time.
I do not wish to delete and re-index these events since the only thing "wrong" is the hostname.

Here is a sample message:
Nov 12 00:00:00 sampleHostname processname[1642]: 6 [yaddayaddaID] The message that follows

I would like to override the hostname field value at search time so instead of forwarder.example.com it will show sampleHostname. If this is at all possible.

0 Karma

MHibbin
Influencer

Hi,

You will need to create/edit the following files in $SPLUNK_HOME/etc/apps/<appName>/local/:

  • props.conf
  • transforms.conf

NOTE: the following is just an example and should be modified to meet your requirements, using the relevant spec files for assistance:

props.conf:
[yourSourceTypeHere]
TRANSFORM-hostnametrans = newHostTrans

transforms.conf:
[newHostTrans]
REGEX = \w+\s+\d+\s+\d+\:\d+\:\d+\s+(?P<host>[^ ])
FORMAT = host::$1
DEST_KEY = MetaData:Host

You will need to restart Splunk to apply this change.

The following docs should be of use here...

http://docs.splunk.com/Documentation/Splunk/5.0/Data/overridedefaulthostassignments
http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf
http://docs.splunk.com/Documentation/Splunk/5.0/admin/Transformsconf

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...