Splunk Search

Summary Index - hostname appended on summary events

stepheneardley
Path Finder

We're summary indexing events from one index into another.  The original index contains JSON events e.g.

{"field1": "value1", "field2": "value2"}

The summary events all have a hostname value appended onto them e.g.

{"field1": "value1", "field2": "value2"}, hostname=abc

I found abc configured in alert_actions.conf under the email stanza;

[email]
hostname = abc

I can't figure out why this is happening and how to remove it from future summary events.  In advanced edit I can see a field called action.summary_index.hostname which contains "abc".  Is it simply inheriting the hostname parameter from alert_actions.conf?

I tried removing the value from this parameter and saving but when I go back into advanced edit the value is back.  This search cluster is quite mature (old...) so I wouldn't be happy simply removing that hostname parameter from alert_actions.conf and "hoping for the best".  I'm not sure where else it might be being used and what impact it could have on other users.

Any thoughts at all would be welcome here.

0 Karma

DanielPriceUK
Path Finder

you could use the collect command

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchReference/Collect

eg:
(table the field with the json data, I'll assume it's _raw

| table _raw
| collect index=<index name> output_format=hec

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...