Hello,
How could we avoid duplicate reporting of the same host?
Hosts (≥ 3)
host Count Last Update
1 Testserver01 2,991,872 01/31/2012 15:23:06
2 TESTSERVER01 2,197,558 01/31/2012 15:23:09
cat /opt/splunk/lib/splunk/defaultdb/db/Hosts.data
0 3 5314043 1319567912 1328020085 1328020085
1 host::Testserver01 2991880 1319567912 1328020026 1328020026
2 host::TESTSERVER01 2197672 1322490713 1328020085 1328020085
Steffen
You can use the upper() function. This function takes one string argument and returns the uppercase version. The lower() function also exists for returning the lowercase version.
Example:
|eval host=upper(host)
More information:
http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/CommonEvalFunctions
Cheers,
Lp
In which config file you need to write this statement to make this permanent?