Handle incorrectly-assigned host values

Handle incorrectly-assigned host values

At some point, you might discover that the host value for some of your events is incorrect for some reason. For example, you might be scraping some Web proxy logs into a directory directly on your Splunk server and you add that directory as an input to Splunk without remembering to override the value of the host field, causing all those events to think their original host value is the same as your Splunk host.

If something like that happens, here are your options, in order of complexity:

• Delete and reindex the entire index.
• Use a search to delete the specific events that have the incorrect host value, and reindex those events.
• Tag the incorrect host values, and use the tag to search.
• Set up a static field lookup to look up the host, map it in the lookup file to a new field name, and use the new name in searches.
• Alias the host field to a new field (such as temp_host), set up a static field lookup to look up the correct host name using the name temp_host, then have the lookup overwrite the original host with the new lookup value (using the OUTPUT option when defining the lookup).

Of these options, the last option will look the nicest if you can't delete and reindex the data, but deleting and reindexing the data will give the best performance.

• Was this topic useful?
• Post a comment