Splunk Search

Set the Host Field to the value of a column in a DB Connect input


One of my database inputs has a column named Server which contains the hostname for whichever machine an app is running on. It would be nice if the host field could map to whatever value is in that column at the time it is brought in, but I haven't found a way to do that.

There's some other questions about how to do something similar with other input types (files, via parsing), but I haven't seen one that I've been able to get working for a database input.

I suppose I could create a new input for each machine that will show up in there (custom query) and then set the static Host Field value to it's hostname but right now I'd rather just have one input.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

if your inputs.conf is like this:


and the field name in table is host_name.

you can set up props.conf and transforms.conf to replace the host name in indexing time.





document could be refer to:


Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...