topic Re: /var/log/messages associated with index host NOT the correct source host in Getting Data In

/var/log/messages associated with index host NOT the correct source host

krussell101 — Thu, 17 Jan 2013 22:26:19 GMT

I have two dozen UF linux systems. All of them are picking up /var/log/messages and sending it to my indexer (the one and only "splunk" host).

All of the /var/log/messages entries are indexed as coming from host=splunk.

WHY?

HELP!

Thanks.

Re: /var/log/messages associated with index host NOT the correct source host

Ayn — Thu, 17 Jan 2013 22:49:56 GMT

What sourcetype do you have for /var/log/messages?

Re: /var/log/messages associated with index host NOT the correct source host

krussell101 — Fri, 18 Jan 2013 20:54:48 GMT

sourcetype = syslog

Re: /var/log/messages associated with index host NOT the correct source host

Lucas_K — Sun, 20 Jan 2013 23:50:50 GMT

Is there a hostname defined on your UF's in /opt/splunkforwarder/etc/system/local/inputs.conf?

Re: /var/log/messages associated with index host NOT the correct source host

krussell101 — Tue, 22 Jan 2013 14:05:06 GMT

No. they pick up the local hostname. Which is how I want it to behave. All other files in /var/log come over with the correct hostname. This is the only file which is attributed to the incorrect host.

Re: /var/log/messages associated with index host NOT the correct source host

krussell101 — Mon, 04 Feb 2013 23:48:26 GMT

This isn't an answer

Re: /var/log/messages associated with index host NOT the correct source host

BryanBerry — Tue, 05 Feb 2013 01:11:01 GMT

Have any stray props.conf/transforms.conf on the indexer? Is this all of your forwarders or only some of them?

Try "splunk btool transforms list --debug > out.txt" on your indexer and grep for MetaData:Host in out.txt. It possible that there's a transform setting the host value to splunk

Re: /var/log/messages associated with index host NOT the correct source host

krussell101 — Mon, 28 Sep 2020 13:14:16 GMT

This is occurring to /var/log/messages from all of my forwarders.

transforms list output:

system [syslog-host]
system CAN_OPTIMIZE = True
system CLEAN_KEYS = True
system DEFAULT_VALUE =
system DEST_KEY = MetaData:Host
system FORMAT = host::splunk-mydomain.com

Is this taking everything of sourcetype syslog and attributing it to another host?

Cool! So now I have to unset that somehow. Thanks!

Re: /var/log/messages associated with index host NOT the correct source host

krussell101 — Tue, 05 Feb 2013 12:12:48 GMT

Any hints on where this may have snuck in? I don't recall doing any transforms at all. Will this be on my forwarders somewhere or on the indexer?

Thanks again.

Re: /var/log/messages associated with index host NOT the correct source host

krussell101 — Tue, 05 Feb 2013 12:14:38 GMT

FOUND IT! THANK YOU!

Re: /var/log/messages associated with index host NOT the correct source host

BryanBerry — Tue, 05 Feb 2013 22:13:32 GMT

Huh, that is very odd. Was that in etc/system/local/transforms.conf or default? Did you find how that got in there? I'm curious about the cause as well.