Skip to content

Commit

Permalink
Update host field in mapping from HEC to the Unified model
Browse files Browse the repository at this point in the history
`host.hostname` attributed was removed from unified model #838. We want to use `host.name` attribute to represent Splunk HEC  "host" field instead.
  • Loading branch information
dmitryax committed Sep 19, 2021
1 parent 02a1679 commit ef45474
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion specification/logs/data-model.md
Original file line number Diff line number Diff line change
Expand Up @@ -687,7 +687,7 @@ We apply this mapping from HEC to the unified model:
<td>host</td>
<td>string</td>
<td>The host value to assign to the event data. This is typically the host name of the client that you are sending data from.</td>
<td>Resource["host.hostname"]</td>
<td>Resource["host.name"]</td>
</tr>
<tr>
<td>source</td>
Expand Down

0 comments on commit ef45474

Please sign in to comment.