topic Re: How to add host name in event ? in Getting Data In

How to add host name in event ?

kml_uvce — Wed, 31 Oct 2012 04:53:12 GMT

I am forwarding data from indexer to heavy forwarder How I can append host name in event (_raw) in indxer that will be forwarded to heavy forwarder ?

yannK — Wed, 31 Oct 2012 06:42:53 GMT

Can you explain why you are doing this ? What is the heavy forwarder sending to ?

If you want to export data, use a scheduled search to export search results formated as you wish

kml_uvce — Thu, 01 Nov 2012 14:41:37 GMT

The actual scenario is like this: I am sending data like this...

universalforwarder -> indexer -> Heavy forwarder -> Syslog-ng server

How Can I get Universal forwarder machine address in Syslog-ng server.

yannK — Thu, 01 Nov 2012 14:51:13 GMT

Here is the method to add any metadata (like host) in the events.
Do that at the indexer level (during index time)

yannK — Mon, 05 Nov 2012 15:18:44 GMT

if the answer suits you, you can accept it.