topic Re: How to forward data with splunk server name inside in Deployment Architecture

How to forward data with splunk server name inside

pmelchiori — Fri, 21 May 2010 20:27:59 GMT

I have four servers in different network with the same Windows Name. I've created a Splunk collector and the logs are collected inside it.

My problem is that I can't split the events!

How can I do to split them in different search?

Re: How to forward data with splunk server name inside

the_wolverine — Fri, 21 May 2010 21:08:11 GMT

You can configure the hostname per Splunk instance. You'll need to update the $SPLUNK_HOME/etc/system/local/inputs.conf to reflect this:

[default]
host = Windows1

Without customizing this, Splunk will use the System's local hostname as its default host setting which, in your case, would be the same for all 4 hosts.

Re: How to forward data with splunk server name inside

gkanapathy — Sat, 22 May 2010 12:51:30 GMT

You may wish to use a fully-qualified hostname. If this is absolutely impossible, you can add a key and index another field into Splunk:

inputs.conf where the inputs are being collected:

newfield = network_id

props.conf on the parsing queue machine(s):

[<host or source or sourcetype specifier>]
TRANSFORMS-setnewfieldtonetworkid = setnetworkid

transforms.conf on the parsing queue machine(s):

[setnetworkid]
SOURCE_KEY = newfield
REGEX = (.*)
FORMAT = newfield::$1

fields.conf on the searcher machine:

[newfield]
INDEXED = True
INDEXED_VALUE = False

Re: How to forward data with splunk server name inside

pmelchiori — Mon, 24 May 2010 14:09:48 GMT

Thanks! I'll try this soon, but why Splunk can't get the name insert in the web interface?

Re: How to forward data with splunk server name inside

pmelchiori — Wed, 09 Jun 2010 16:36:05 GMT

Thanks, it works!