The host field value of an event is the name of the physical device from which the event originates. Because it is a default field, which means that Splunk software assigns a host to every event it indexes, you can use it to search for all events that have been generated by a particular host.
The host value is typically the hostname, IP address, or fully qualified domain name of the network host on which the event originated.
How the host value is determined
Splunk software assigns a host value to each event by examining settings in the following order and using the first host setting it encounters:
1. Any event-specific host assignment that you specify in
2. The default host value for the input that created the event, if any.
3. The default host value for the Splunk indexer or forwarder that initially consumes the data.
An overview of these assignment methods and their use cases follows. Subsequent topics describe the methods in greater detail.
The default host value
If no other host rules are specified for a source, Splunk software assigns the host field a default value that applies to all data coming into the instance from any input. The default host value is the hostname or IP address of the Splunk indexer or forwarder initially consuming the data. When the Splunk instance runs on the server where the event occurred, this is correct and no manual intervention is required.
For more information, see Set a default host for a Splunk instance in this manual.
The default host for a file or directory input
If you run Splunk Enterprise on a central log archive, or you are working with files that are forwarded from other hosts in your environment, you might need to override the default host assignment for events coming from particular inputs.
There are two methods for assigning a host value to data received through a particular input. You can define a static host value for all data coming through a specific input, or you can have Splunk software dynamically assign a host value to a portion of the path or filename of the source. The latter method can be helpful when you have a directory structure that segregates each host's log archive in a different subdirectory.
For more information, see Set a default host for a file or directory input in this manual.
Some situations require you to assign host values by examining the event data. For example, If you have a central log host sending events to your Splunk deployment, you might have several host servers that feed data to that main log server. To ensure that each event has the host value of its originating server, you need to use the event's data to determine the host value.
For more information, see Set host values based on event data in this manual.
Handle incorrectly-assigned host values
If your event data gets tagged with the wrong host value, don't worry. There are a number of ways to fix or work around the problem.
For details, see Change host values after indexing in this manual.
Tag host values
You can tag host values to aid in the execution of robust searches. Tags enable you to cluster groups of hosts into useful, searchable categories.
For details, see About tags and aliases in the Knowledge Manager manual.
Process events with ingest-time eval
Set a default host for a Splunk instance
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.3.1, 7.3.0, 7.3.2