Hello,
We have a Splunk deployment that has been adding the domain to the host name field.
This has been causing issues for our alerts of hosts not reporting to Splunk, because the host name changes from <host name> to <host name>.<domain>.com.
Is there any way to force just the <host name> and remove the <domain>.com?
Thanks!
You can use a RegEx to get the host
field from the events, provided host
is logged in the event somewhere. You have to configure this in props.conf
& transforms.conf
. Let's say the host
is the first field in the event, then you do it like this:
props.conf
[source::mysource]
TRANSFORMS-ho=hostoverride
transforms.conf
[hostoverride]
DEST_KEY = MetaData:Host
REGEX = ^([^\.,]+)
FORMAT = host::$1
If host
is not in the event, then adding this line to the hostoverride
stanza in transforms.conf
(to tell it to use the current host
value as the string for the RegEx instead of _raw
) might work but I have never tried it:
SOURCE_KEY = MetaData:Host
So the host field is already being extracted, the issue that I'm seeing is that sometimes Splunk adds the domain to the events and sometimes it doesn't.
Right, so I am saying "deal with it" and force host
to be rewritten when this happens.