change hostname in data summary

[khanlarloo]

hi
i have problem in splunk.our company has firewall and the logs of firewall is sending to splunk,i want to change the hostanem in data summary but i can't.
can you help me to change the nme of hostname in data summary ?
in input.conf
C:\Program Files\Splunk\etc\system\local\input
there is nothing to change.

tanx

[jplumsdaine22]

You need to find the inputs.conf that is monitoring your firewall logs. Possibly they are coming in via a tcp connection direct to your indexer.

There will be an inputs.conf file stanza like [monitor://some\file] or [tcp:514]in there you can simply set a key to override the host like host=my-override

See here for the inputs.conf documentation.

If you're having trouble locating try searching for the sourcetype in the Splunk folder

[micahkemp]

Will you post your inputs.conf? You probably have a [monitor] stanza that defines the host.

Or, if this is the result of a summary-indexing search, the host field will be the name of the search head that ran the search and created the summary data. If that's the case, you probably don't want to override the host field, but instead have your summary search include a different field name for the host of the summary data, perhaps h (which is what Splunk uses in the _internal index to denote a host different from the one that generated the data).

[khanlarloo]

hi
tanx for your response,
in my input.conf there is nothing axcept

[default]
host = Splunk

and in my data summary for the name of my host is ip add .
i want to change the ip to name but i can't.