Getting Data In

host value for windows

cmeo
Contributor

I've seen a few postings on this topic, but there doesn't seem to be final solution. I'm getting up to four different styles of host name from my windows boxes:

  1. COMPUTER NAME (all upper case, not fqdn)
  2. computer name (all lower case, not fqdn)
  3. computer.domain.com.au (the value I actually want, canonical DNS fqdn)
  4. computer.windows-domain.com.au (derived from AD info if present)

This is annoying, and I'd like to know if there is one spot where I can set option 3 such that it will override all the others. So far I haven't found it. Furthermore it would great if splunk installation prompted for this, so you don't have to find and edit the files.

Tags (1)

cmeo
Contributor

Figured out how to do it with yet another ugly hack. You can get the host name part of the windows computer name, however it appears, with this:

eval x=split(host, ".") | eval w_host=mvindex(x,0)

This normalises your hostname if it does have the domain part, but still works if it doesn't.

You can then use this in a form to match your windows host however it appears:

sourcetype=wmi:cputime host=*$w_host$*

which normalises data sources which do not have the domain part, but still works if they do.

Nasty, should be unnecessary, but it works.

0 Karma

lguinn2
Legend

There is no single place that this can be set. If you want to set a consistent host format, the most direct way is to set it explicitly for each input. This can be a painful solution if you are using the deployment server and/or have many Windows forwarders.

You will also need to override TRANSFORMS = syslog-host Splunk automatically applies the syslog-host transformation to some of the sourcetypes that are syslog-based. To override it, you will need to add

TRANSFORMS=

to the appropriate sourcetype stanza of props.conf on all of the indexers. If you use "heavy" forwarders, you will also need to set it there as well.

You could submit this to Splunk Support as an enhancement request. (The more requests, the more likely that someone will add this as a feature in a future release...)

cmeo
Contributor

The silence has been deafening...

0 Karma

jdunlea_splunk
Splunk Employee
Splunk Employee

I am also finding this problem... Does anybody have any solution??

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...