Implementing Splunk 7, Third Edition - Third Edition

Overriding the host

If your hostnames are appearing differently from different sources, for instance, syslog versus Splunk forwarders, you can use a transform to normalize these values. Given our hostname, vlbmba.local, we may want to only keep the portion to the left of the first period. The stanza would look like this:

[normalize_host] 
SOURCE_KEY = MetaData:Host 
DEST_KEY = MetaData:Host 
REGEX = (.*?). 
FORMAT = host::$1 

This will replace our hostname with vlbmba. Note these two things:

• WRITE_META is not included, because we are not adding to the metadata of this event; we are instead overwriting the value of a core metadata field
• host:: must be included at the beginning of the format