Splunk Search

Set the Host Field to the value of a column in a DB Connect input


One of my database inputs has a column named Server which contains the hostname for whichever machine an app is running on. It would be nice if the host field could map to whatever value is in that column at the time it is brought in, but I haven't found a way to do that.

There's some other questions about how to do something similar with other input types (files, via parsing), but I haven't seen one that I've been able to get working for a database input.

I suppose I could create a new input for each machine that will show up in there (custom query) and then set the static Host Field value to it's hostname but right now I'd rather just have one input.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

if your inputs.conf is like this:


and the field name in table is host_name.

you can set up props.conf and transforms.conf to replace the host name in indexing time.





document could be refer to:


Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...