if your inputs.conf is like this: [dbmon-tail:........] sourcetype=table_with_host and the field name in table is host_name. you can set up props.conf and transforms.conf to replace the host name in indexing time. props.conf: [table_with_host] TRANSFORMS-host_rename=rename_host_by_field_host transforms.conf: [rename_host_by_field_host] SOURCE_KEY=fields:hostname DEST_KEY=MetaData:Host document could be refer to: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Overridedefaulthostassignments ... View more

Note, this does not clear up space but rather mark those events as deleted. ... View more