topic Re: Heavy Forwarder sending incorrect Host in Getting Data In

Heavy Forwarder sending incorrect Host

adelucaa — Fri, 01 Aug 2014 13:09:27 GMT

We have a heavy forwarder set up on our log server. It is sending to rsyslog and then forwarding to the indexer.

If I send it directly from the forwarder to the indexer, then I receive the log server as the host field. If I send it through to the rsyslog, then I receive localhost in in the host field.

This is our config on the heavy forwarder:

outputs.conf

[syslog:syslog_group]
server = IndexerIP:514
type = tcp
inputs.conf
[tcp://:9997]

props.conf

[host::*]
TRANSFORMS-sys = syslogrouting

transforms.conf

[syslogrouting]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslog_group

The indexer is set to receive in syslog format.

Re: Heavy Forwarder sending incorrect Host

grijhwani — Fri, 01 Aug 2014 13:23:01 GMT

Simple answer: don't use Splunk's syslog service. Use syslog-ng (or something like) and use Splunk to then sweep those logs. syslog-ng can be tailored to store logs based on hostname, ip address, date, etc., which then makes granular indexing within Splunk a doddle.

Re: Heavy Forwarder sending incorrect Host

adelucaa — Sat, 02 Aug 2014 16:16:03 GMT

After the heavy forwarder, we send to rsyslog(which we would like to be receiving in syslog format). We only use the heavy forwarder, because we need to receive from the light forwarders and forward to the syslog. How would I set the heavy forwarder to forward, but not index? Thank you.