Getting Data In

Splunk adding domain to host name

Volto
Path Finder

Hello,

We have a Splunk deployment that has been adding the domain to the host name field.

This has been causing issues for our alerts of hosts not reporting to Splunk, because the host name changes from <host name> to <host name>.<domain>.com.

Is there any way to force just the <host name> and remove the <domain>.com?

Thanks!

0 Karma

woodcock
Esteemed Legend

You can use a RegEx to get the host field from the events, provided host is logged in the event somewhere. You have to configure this in props.conf & transforms.conf. Let's say the host is the first field in the event, then you do it like this:

props.conf

[source::mysource]
TRANSFORMS-ho=hostoverride

transforms.conf

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = ^([^\.,]+)
FORMAT = host::$1

If host is not in the event, then adding this line to the hostoverride stanza in transforms.conf (to tell it to use the current host value as the string for the RegEx instead of _raw) might work but I have never tried it:

SOURCE_KEY = MetaData:Host
0 Karma

Volto
Path Finder

So the host field is already being extracted, the issue that I'm seeing is that sometimes Splunk adds the domain to the events and sometimes it doesn't.

0 Karma

woodcock
Esteemed Legend

Right, so I am saying "deal with it" and force host to be rewritten when this happens.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...