How to change a host from test01 to test02 for a specific sourcetype ?

[Hemnaath]

Hi All, Currently we have request to change only the host from test01 to test02 for a sourcetype=sap:script:error and source=///export/home/ct/script/jobtrigger/.log*.

We have customized app for monitoring this log and it is mapped to the host = test01. In serverclass.conf , test01 is present in the include (whitelist) and by changing the client from test01 to test02 custom app will be pointed to new host test02.

Both in test01 and test02 splunk agent is running.

So by doing the above step will it fix the issue? Got a doubt so posted it before doing the changes in Prod.

thanks in advance.

[yannK]

If you want to use the same app everywhere :

• rename the host field at index time :

create a props.conf that will call a transforms for your sourcteype
them create a transforms.conf that will replace the host under certain regex matching condition, and will rename test01 to test02 in my example

 # props.conf
 [sap:script:error]
 TRANSFORMS-change-host=renamehost_test


 #transforms.conf to change Host
 [renamehost_test] 
SOURCE_KEY = MetaData:Host
 REGEX = (test01) 
 DEST_KEY = MetaData:Host 
 FORMAT = sourcetype::test02

Deploy the rules on the the indexers or first heavy forwarders (if you have any)

• otherwise, why not remove the host=test01 from the inputs.conf and let splunk use the automatic one from $SPLUNK_HOME/etc/system/local/inputs.conf ? It's easier and automatic

[Hemnaath]

Hi Yannk, thanks for your effort on this, I had changed the host=test01 to test02 by changing the host name from the serverclass.conf , i had removed the old hostname and added the new hostname. Actually client wants to remove the app from the old node and want to point to the new node.
it resolved the issue. thanks for your support on this.