If your hostnames are appearing differently from different sources, for instance, syslog versus Splunk forwarders, you can use a transform to normalize these values. Given our hostname, vlbmba.local, we may want to only keep the portion to the left of the first period. The stanza would look like this:
[normalize_host] SOURCE_KEY = MetaData:Host DEST_KEY = MetaData:Host REGEX = (.*?). FORMAT = host::$1
This will replace our hostname with vlbmba. Note these two things:
- WRITE_META is not included, because we are not adding to the metadata of this event; we are instead overwriting the value of a core metadata field
- host:: must be included at the beginning of the format
