topic Removed the syslog-host transform - but hostname is still getting pulled from /var/log/messages in Getting Data In

Removed the syslog-host transform - but hostname is still getting pulled from /var/log/messages

di2esysadmin — Tue, 25 Feb 2014 13:06:26 GMT

Sourcetype=syslog results are picking up the short hostname from the /var/log/messages file. I tried to correct this per the instructions here : http://answers.splunk.com/answers/6895/can-i-prevent-the-default-index-time-extraction-for-the-host-field-to-occur-for-events-of-the-syslog-sourcetype

Specifically, I now have a local/props.conf file. The contents are as follows:

[syslog]
TRANSFORMS =

The output looks correct, TRANSFORMS is null. Yet the hostname is still getting set to the shortname, presumably from the shortname in the /var/log/messages file.

splunk cmd btool props list syslog --debug Splunk_TA_ [syslog] system ANNOTATE_PUNCT = True system BREAK_ONLY_BEFORE = system BREAK_ONLY_BEFORE_DATE = True . . system TIME_FORMAT = %b %d %H:%M:%S system TRANSFORMS = system TRUNCATE = 10000 . .

Any ideas?

Thanks,
Karla

Re: Removed the syslog-host transform - but hostname is still getting pulled from /var/log/messages

di2esysadmin — Tue, 25 Feb 2014 14:48:58 GMT

An additional related question . . . once I get this working the way I want, is it possible to change the hostname settings for data already indexed? Or this that just a ridiculous question?

Re: Removed the syslog-host transform - but hostname is still getting pulled from /var/log/messages

martin_mueller — Tue, 25 Feb 2014 20:29:43 GMT

To change already-indexed data you would need to remove it and re-index.

Re: Removed the syslog-host transform - but hostname is still getting pulled from /var/log/messages

di2esysadmin — Thu, 27 Feb 2014 13:53:24 GMT

As I suspected. Thanks Martin.

Any suggestions on how to solve the problem I posed? 🙂

Re: Removed the syslog-host transform - but hostname is still getting pulled from /var/log/messages

jreuter_splunk — Tue, 11 Mar 2014 20:00:42 GMT

More information would be required to understand why this is not taking effect. First guess: did you make this change to props.conf on the forwarder? It needs to be configured on the indexer as the forwarder only handles the input stage. The following props.conf subset is applied on a universal/lightweight forwarder:

sourcetype CHARSET NO_BINARY_CHECK CHECK_METHOD CHECK_FOR_HEADER PREFIX_SOURCETYPE

Reference:
Where do I configure my Splunk settings?

Verify the above, along with the final sourcetype. Look for other transforms that are related to the source or other attributes. Reply to your open support case if none of this helps to resolve the issue.

Re: Removed the syslog-host transform - but hostname is still getting pulled from /var/log/messages

di2esysadmin — Thu, 13 Mar 2014 11:33:31 GMT

I did NOT make it on the indexer. Got it in one ! thanks.