incorrect host names

[lain179]

I extracted the host names wrong, and now I have extra names in my Splunk. Example: Server01 vs. Server1 and Server02 vs. Server2, etc.

What's the best way to fix this so I only have Server01, Server02, etc.? Delete? Rename? Any suggestions?

Thanks!

[stefandagerman · Accepted solution]

If you don't want to or cannot reindex your data, I would probably use tags or create a new field with an appropriate RegEx that normalizes your server names. You'd then use the tag or new field name in your searches rather than the original server name.

[lain179]

Ok, thanks!

[stefandagerman]

Yes you can, with a userid that has can_delete privilege (admin does not have that by default).
Construct a search that returns all events you want deleted, make sure the result is what you expect and add "| delete" once you are sure.
Note that events will not be deleted physically, so if you want to reclaim the disk space immediately, I think you would have to delete and recreate the index and re-index everything.

[lain179]

I don't need those logs with wrong host names as I re-import the data with correct host names. So can I just delete them? Is there a way to selectively delete indexed data?

[stefandagerman]

Note that that new field won't be indexed like the 'host' field is.

[kristian_kolb]

You cannot rename the host field, once it's been indexed. However, you can dynamically change it as part of the search for the duration of that search. (say you indexed server1.domain.com, buy you just wanted the server1)

... | rex field=host "(?<host>[^.]+)" | ...

Not really neat. Will probably have effects on drill-downs etc, where the new host field value won't match indexed data....Other than that, wait until the data ages out of your index.. or delete and re-index.

/K