https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162533#M32997 <P>I don't want to extract the hostname from the syslog event, the hostname is localhost and it's not correct. I know the event came from a specific server so I'm trying to replace the hostname with the specific server name. Putting host=server1 in inputs.conf changes some of the records but not all. What can I do to change all of them.</P> Wed, 30 Jul 2014 16:27:37 GMT plj3736 2014-07-30T16:27:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162530#M32994 <P>I'm getting data in syslog format with the host set to localhost. I know what server this is coming from but don't have authority to change the hostname at the server. The data is being put into a directory on my local server, not through UDP or TCP transfer. Here's what I have in inputs.conf</P> <P>[monitor:///home/Analysis/tc-1/server1/*.gz]<BR /> index=tc-1<BR /> host=server1<BR /> disabled=false</P> <P>I've tried this both with and without sourcetype=syslog as added input here. A few of the records come in as host of server1 but most have localhost listed as the source. Any help would be appreciated.</P> Tue, 29 Jul 2014 23:31:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162530#M32994 plj3736 2014-07-29T23:31:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162531#M32995 <P>Splunk automatically extracts the host from syslog events, overwriting the setting from inputs.conf because usually the event is more accurate than using the central syslog daemon's host.</P> <P>To avoid that happening to your events you could set a different sourcetype than syslog.</P> Tue, 29 Jul 2014 23:52:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162531#M32995 martin_mueller 2014-07-29T23:52:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162532#M32996 <P>I don't want to extract the hostname from the syslog event, the hostname is localhost and it's not correct. I know the event came from a specific server so I'm trying to replace the hostname with the specific server name. Putting host=server1 in inputs.conf changes some of the records but not all. What can I do to change all of them.</P> Wed, 30 Jul 2014 16:27:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162532#M32996 plj3736 2014-07-30T16:27:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162533#M32997 <P>I don't want to extract the hostname from the syslog event, the hostname is localhost and it's not correct. I know the event came from a specific server so I'm trying to replace the hostname with the specific server name. Putting host=server1 in inputs.conf changes some of the records but not all. What can I do to change all of them.</P> Wed, 30 Jul 2014 16:27:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162533#M32997 plj3736 2014-07-30T16:27:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162534#M32998 <P>I don't want to extract the hostname from the syslog event, the hostname is localhost and it's not correct. I know the event came from a specific server so I'm trying to replace the hostname with the specific server name. Putting host=server1 in inputs.conf changes some of the records but not all. What can I do to change all of them.</P> Wed, 30 Jul 2014 16:28:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162534#M32998 plj3736 2014-07-30T16:28:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162535#M32999 <P>you cant change them now, you need to delete them all and re-index if you require single host name.</P> Wed, 30 Jul 2014 17:13:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-host-in-inputs-conf/m-p/162535#M32999 linu1988 2014-07-30T17:13:54Z