Splunk Search

Duplicate Host Field from JSON Event

max_weber
Explorer

Hey there,

we are pumping millions of Zabbix events in to our splunk environment over a Heavy Forwarder. The events are JSON string like this:

{"host":"myHostname","groups":["OS_RHEL","OS_RHEL_ES"],"applications":["FS RHELBASIC","Filesystems"],"itemid":1234,"name":"/var/log - used space (total)","clock":1562748008,"ns":583690877,"value":194605056}

the props for this sourcetype looks like this:

props.conf
TIME_PREFIX=\"clock\"\:
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
SHOULD_LINEMERGE=false

At first my problem was that the host field was filled with the hostname of the Heavy Forwarder. For easier use for our users, i want the host from the JSON event in my splunk "host" field. I tried to do that with following transforms:

[set_hostname_zabbix]
REGEX = "host":"(?P<host>[^"]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host

This kind of worked, but now my problem is that i got two host fields both filled with the same data.
Any ideas how I can fix this, so I just get one host field filled with the hostname from the JSON event?

Regards,

Max

0 Karma

woodcock
Esteemed Legend

You have 2 options. You could set KV_MODE = none and because you are using indexed_extractions anyway, this should work fine. You could also set a calculated field like this: eval-host=mvdedup(host).

0 Karma

max_weber
Explorer

thanks for you advice. i have to try this.

but I think the first method won't help, cause the "host" field is a field which is always extracted not depending on the KV_MODE setting.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...