topic Re: wrong HOST value in Getting Data In

wrong HOST value

sunnykkim — Wed, 28 Jul 2010 00:50:45 GMT

Hi,

I have a forwarder sending a syslog file to the receiver. The syslog has entries like:

Jul 27 09:50:21 ip-10-196-173-139 postfix .....

And I don't want the "ip-10-196-173-139" to show up as the "host" on the receiver when doing searches. So I edited the "inputs.conf" like this:

[default]
host = abc.mydomain.com

[monitor:///var/log/syslog]
disabled = false
host = abc.mydomain.com

I did this in a bunch of places since nothing seemed to work:

/opt/splunk/etc/system/local/inputs.conf

/opt/splunk/etc/apps/search/local/inputs.conf

/opt/splunk/etc/apps/SplunkLightForwarder/local/inputs.conf

I also tried restarting Splunk (both on forwarder and receiver). But I'm still seeing the "ip-10-196-173-139" as the host on the receiver side when doing searches.

This is driving me crazy. Can anyone help?

Thanks! Sunny

Re: wrong HOST value

Chris_R_ — Wed, 28 Jul 2010 06:41:22 GMT

Hello Sunny,

Since Splunk syslog's default extractions are taken directly from the event data, you have to override it another way. Try these settings all on your indexer(receiver).

$SPLUNK_HOME/etc/system/local/props.conf  
[host::ip-10-196-173-139]  
TRANSFORMS = newhost  

$SPLUNK_HOME/etc/system/local/transforms.conf   
[newhost]  
DEST_KEY = MetaData:Host   
REGEX = .  
FORMAT = host::newhostname.domain.com

If you have more then just syslog data coming from this host, you may need to set a custom sourcetype on your forwarder to filter off instead of your host in props.conf. let me know how it goes.

Re: wrong HOST value

Stephen_Sorkin — Wed, 25 Aug 2010 10:10:00 GMT

The easiest way to solve this problem is by specifying a sourcetype other than syslog in inputs.conf.

For example, try:

[monitor:///var/log/syslog]
disabled = false
host = abc.mydomain.com
sourcetype = notsyslog

For data believed to be syslog, Splunk will try to extract the host from each line. This usually is what's wanted, but that's not always the case. Chris R.'s suggestion is close, but will not work, since at the time that props.conf is consulted for this data, the host is set to abc.mydomain.com, as you configured. It's the regex mechanism that's responsible for changing it.

Re: wrong HOST value

Lowell — Wed, 25 Aug 2010 10:17:43 GMT

For most of my systems the syslog host only contains the short form "host", and not the fully qualified domain name; which is what I want to see in splunk. So I use a transformer (like what Chris R suggests) to simply append a static domain name to my short host.

If this sounds helpful, you can check it out here:

hostname rename using TRANSFORMS