topic Re: How do I force IP address for host property instead of hostname in Getting Data In

How do I force IP address for host property instead of hostname

tstclair — Fri, 01 Feb 2013 17:51:07 GMT

In the inputs.conf file you have the option to specific a 'host' property. Per the documentation.

If not set explicitly, this defaults
to the IP address or fully qualified
domain name of the host where the data
originated.

All my traffic is coming in under the system hostname but I want to force this to be the IP address. I've looked and looked and can't seem to find the answer, How do I set host = IP?

Re: How do I force IP address for host property instead of hostname

jeff — Fri, 01 Feb 2013 18:43:30 GMT

I haven't tried it, but I don't see why you couldn't set your host parameter to the IP address on each Splunk forwarder:

etc/local/inputs.conf
=====================
[default]
host = 172.18.1.1

for instance.

Re: How do I force IP address for host property instead of hostname

tstclair — Fri, 01 Feb 2013 18:55:00 GMT

I'd expect that this would work to send all traffic as 172.18.1.1 but hard coding a value isn't viable for me.

The Splunk forwarders are running in AWS on EC2 instances. I may have N number of these E2C instances running which all have been started from the same image. With this solution I'd get all nodes reporting as 172.18.1.1.

Thanks for the response though. Any other thoughts?

Re: How do I force IP address for host property instead of hostname

jeff — Fri, 01 Feb 2013 22:19:32 GMT

Not any great ones... not sure if the parameter may take an environment variable? Might be worth trying- have a script set an IP variable, then set

host=$IP

on system boot before running Splunk. I don't have a lot of confidence in this, but might be worth a shot.