Override host field value at search time

[mihelic]

We have some old indexed events that have their host field value set to the name of the forwarder on the central syslog host. It appears, that hostname extraction was not configured correctly at that time.
I do not wish to delete and re-index these events since the only thing "wrong" is the hostname.

Here is a sample message:
Nov 12 00:00:00 sampleHostname processname[1642]: 6 [yaddayaddaID] The message that follows

I would like to override the hostname field value at search time so instead of forwarder.example.com it will show sampleHostname. If this is at all possible.

[MHibbin]

Hi,

You will need to create/edit the following files in $SPLUNK_HOME/etc/apps/<appName>/local/:

• props.conf
• transforms.conf

NOTE: the following is just an example and should be modified to meet your requirements, using the relevant spec files for assistance:

props.conf:
[yourSourceTypeHere]
TRANSFORM-hostnametrans = newHostTrans

transforms.conf:
[newHostTrans]
REGEX = \w+\s+\d+\s+\d+\:\d+\:\d+\s+(?P<host>[^ ])
FORMAT = host::$1
DEST_KEY = MetaData:Host

You will need to restart Splunk to apply this change.

The following docs should be of use here...

http://docs.splunk.com/Documentation/Splunk/5.0/Data/overridedefaulthostassignments
http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf
http://docs.splunk.com/Documentation/Splunk/5.0/admin/Transformsconf