Splunk Search

Replace/rename a host name with another host name

Adrian
Path Finder

Hello,

I would like to rename/replace host name (ip-10-0-0-4) with host name (XXXXXX-GOC-MON-01). I found this similar issue but it is slightly different and doesn't work for me:

host rename using TRANSFORMS

Specifically looking to extract from a syslog sourcetype the word or IP directly after HH:MM:SS and replace it with a host name.

Apr 25 19:11:38 ip-10-0-0-4 kernel: Kernel logging (proc) stopped.

Apr 25 19:11:38 192.168.1.1 kernel: Kernel logging (proc) stopped.

I have absolutely no experience with regex but tried putting some things together from tutorials. I am trying this regex to capture the data directly after HH:MM:SS

(?<=([0-1]\d|2[0-3]):([0-5]\d):([0-5]\d)

transforms.conf               
[syslog_host_rename]  
REGEX = (?<=([0-1]\d|2[0-3]):([0-5]\d):([0-5]\d))  
DEST_KEY = MetaData:Host
FORMAT = host::XXXXXX-GOC-MON-01 

props.conf
[host::XXXXXXX-GOC-MON-01]
TRANSFORMS-host_rename = syslog_host_rename

Hopefully this makes my goals a litte more clear. Any suggestions would be greatly appreciated!

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

Using a host tag would also work for some cases. Again, this isn't replacing the original value of host= but supplementing it - allowing you to search by the tag, which takes on the value of all of the different names you know the host as, without changing the original stored value of host.

Splunk does not provide a way to change that which has already been indexed. If it was indexed with host=foo then it will always be host=foo until such a time as that data is purged per your index retention policies.

Using the props/transforms approach you linked to above will let you (at index time) change the value of host= for newly arriving events. But, it can't do anything for prior indexed events.

jrodman
Splunk Employee
Splunk Employee

It's hard to know if this is about data coming from a forwarder with a value other than what you want in the default inputs.conf, or if it's data from a device where you can't control the values used, or some other scenario. The best remedy depends upon the scenario. Generically, at search time, there isn't a way to permanently modify the data in the index.

0 Karma

MarioM
Motivator

can you paste sample data and the props/transforms configs you tried?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Maybe try creating an alias for the field? See Create aliases for fields in the Knowledge Manager Manual.

Adrian
Path Finder

Thanks for your input I wasn't completely clear on my requirements.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

True, the original field is not removed. I understood from your question that renaming would be acceptable. Apparently not? Other options for renaming: you can use the replace command in your search, set the host variable in inputs.conf, or rewrite it with transforms and/or props.conf. I don't know if you can actually replace the value completely.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...