Splunk Search

Summary Index - hostname appended on summary events

stepheneardley
Path Finder

We're summary indexing events from one index into another.  The original index contains JSON events e.g.

{"field1": "value1", "field2": "value2"}

The summary events all have a hostname value appended onto them e.g.

{"field1": "value1", "field2": "value2"}, hostname=abc

I found abc configured in alert_actions.conf under the email stanza;

[email]
hostname = abc

I can't figure out why this is happening and how to remove it from future summary events.  In advanced edit I can see a field called action.summary_index.hostname which contains "abc".  Is it simply inheriting the hostname parameter from alert_actions.conf?

I tried removing the value from this parameter and saving but when I go back into advanced edit the value is back.  This search cluster is quite mature (old...) so I wouldn't be happy simply removing that hostname parameter from alert_actions.conf and "hoping for the best".  I'm not sure where else it might be being used and what impact it could have on other users.

Any thoughts at all would be welcome here.

0 Karma

DanielPriceUK
Path Finder

you could use the collect command

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchReference/Collect

eg:
(table the field with the json data, I'll assume it's _raw

| table _raw
| collect index=<index name> output_format=hec

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...