Replace/rename a host name with another host name

[Adrian]

Hello,

I would like to rename/replace host name (ip-10-0-0-4) with host name (XXXXXX-GOC-MON-01). I found this similar issue but it is slightly different and doesn't work for me:

host rename using TRANSFORMS

Specifically looking to extract from a syslog sourcetype the word or IP directly after HH:MM:SS and replace it with a host name.

Apr 25 19:11:38 ip-10-0-0-4 kernel: Kernel logging (proc) stopped.

Apr 25 19:11:38 192.168.1.1 kernel: Kernel logging (proc) stopped.

I have absolutely no experience with regex but tried putting some things together from tutorials. I am trying this regex to capture the data directly after HH:MM:SS

(?<=([0-1]\d|2[0-3]):([0-5]\d):([0-5]\d)

transforms.conf               
[syslog_host_rename]  
REGEX = (?<=([0-1]\d|2[0-3]):([0-5]\d):([0-5]\d))  
DEST_KEY = MetaData:Host
FORMAT = host::XXXXXX-GOC-MON-01 

props.conf
[host::XXXXXXX-GOC-MON-01]
TRANSFORMS-host_rename = syslog_host_rename

Hopefully this makes my goals a litte more clear. Any suggestions would be greatly appreciated!

[dwaddle]

Using a host tag would also work for some cases. Again, this isn't replacing the original value of host= but supplementing it - allowing you to search by the tag, which takes on the value of all of the different names you know the host as, without changing the original stored value of host.

Splunk does not provide a way to change that which has already been indexed. If it was indexed with host=foo then it will always be host=foo until such a time as that data is purged per your index retention policies.

Using the props/transforms approach you linked to above will let you (at index time) change the value of host= for newly arriving events. But, it can't do anything for prior indexed events.

[jrodman]

It's hard to know if this is about data coming from a forwarder with a value other than what you want in the default inputs.conf, or if it's data from a device where you can't control the values used, or some other scenario. The best remedy depends upon the scenario. Generically, at search time, there isn't a way to permanently modify the data in the index.

[MarioM]

can you paste sample data and the props/transforms configs you tried?

[ChrisG]

Maybe try creating an alias for the field? See Create aliases for fields in the Knowledge Manager Manual.

[Adrian]

Thanks for your input I wasn't completely clear on my requirements.

[ChrisG]

True, the original field is not removed. I understood from your question that renaming would be acceptable. Apparently not? Other options for renaming: you can use the replace command in your search, set the host variable in inputs.conf, or rewrite it with transforms and/or props.conf. I don't know if you can actually replace the value completely.