topic Re: host value for windows in Getting Data In

host value for windows

cmeo — Fri, 12 Aug 2011 01:00:24 GMT

I've seen a few postings on this topic, but there doesn't seem to be final solution. I'm getting up to four different styles of host name from my windows boxes:

COMPUTER NAME (all upper case, not fqdn)
computer name (all lower case, not fqdn)
computer.domain.com.au (the value I actually want, canonical DNS fqdn)
computer.windows-domain.com.au (derived from AD info if present)

This is annoying, and I'd like to know if there is one spot where I can set option 3 such that it will override all the others. So far I haven't found it. Furthermore it would great if splunk installation prompted for this, so you don't have to find and edit the files.

Re: host value for windows

jdunlea_splunk — Fri, 26 Aug 2011 14:51:03 GMT

I am also finding this problem... Does anybody have any solution??

Re: host value for windows

cmeo — Fri, 02 Sep 2011 02:32:05 GMT

The silence has been deafening...

Re: host value for windows

lguinn2 — Sat, 03 Sep 2011 16:44:22 GMT

There is no single place that this can be set. If you want to set a consistent host format, the most direct way is to set it explicitly for each input. This can be a painful solution if you are using the deployment server and/or have many Windows forwarders.

You will also need to override TRANSFORMS = syslog-host Splunk automatically applies the syslog-host transformation to some of the sourcetypes that are syslog-based. To override it, you will need to add

TRANSFORMS=

to the appropriate sourcetype stanza of props.conf on all of the indexers. If you use "heavy" forwarders, you will also need to set it there as well.

You could submit this to Splunk Support as an enhancement request. (The more requests, the more likely that someone will add this as a feature in a future release...)

Re: host value for windows

cmeo — Wed, 16 May 2012 05:00:55 GMT

Figured out how to do it with yet another ugly hack. You can get the host name part of the windows computer name, however it appears, with this:

eval x=split(host, ".") | eval w_host=mvindex(x,0)

This normalises your hostname if it does have the domain part, but still works if it doesn't.

You can then use this in a form to match your windows host however it appears:

sourcetype=wmi:cputime host=*$w_host$*

which normalises data sources which do not have the domain part, but still works if they do.

Nasty, should be unnecessary, but it works.