Deployment Architecture

Replace Index Value Permanently

llow
Explorer

I want to know how to replace a value inside in index permanently. I know I can use replace to replace it during search time but want to modify the actual value inside the index permanently.

I need this as equipment hostnames may change but I want to keep historical data for that host under the same indexed value.

Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee

Splunk is unlike a relational-database in that once a value is written to the index, it cannot be removed/replaced surgically.

Thus, for historical data, you will need to reindex the data in question and then use a SED command to do the replacement:

http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/Anonymizedatausingconfigurationfiles#Through_...

Unless you reindex your old data, the replacement will be effective only for data going forward.

lguinn2
Legend

You could also create a lookup table that maps ip addresses (or old hostnames) to current hostnames. Set it as an automatic lookup and you will always have a field that represents the current hostname. You will only have to maintain a text file (CSV) of the mapping - and you could automate the update of the CSV file.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutlookupsandfieldactions

0 Karma

araitz
Splunk Employee
Splunk Employee

You could use tags on the host field, or normalize hostnames using search-time extractions. Both these approaches solve your problem without permanently replacing indexed values.

http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Tagthehostfield

http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Createandmaintainsearch-timefieldextract...

0 Karma

llow
Explorer

Eww, there is no easier way to do this? I wanted to automate the process when a hostname change is made in our core monitoring system.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!