topic Re: wrong host in Getting Data In

wrong host

vinchakov_a — Fri, 16 May 2014 04:01:54 GMT

Hello, please help me. I through splunkforwarder try to load a look log:

May 16 03:36:57 corosync [CMAN  ] daemon: sending reply 40000005 to fd 32
May 16 03:36:57 corosync [CMAN  ] daemon: read 20 bytes from fd 32
May 16 03:36:57 corosync [CMAN  ] daemon: client command is 7
May 16 03:36:57 corosync [CMAN  ] daemon: About to process command
May 16 03:36:57 corosync [CMAN  ] memb: command to process is 7
May 16 03:36:57 corosync [CMAN  ] memb: get_all_members: retlen = 880

And splunk changes host name for corosync how to bypass it?

Re: wrong host

linu1988 — Fri, 16 May 2014 04:14:45 GMT

mention host name for the input in the splunkforwarder.

Re: wrong host

vinchakov_a — Fri, 16 May 2014 04:48:36 GMT

I tryed^

[default]
host = myname

It not help.

Re: wrong host

linu1988 — Fri, 16 May 2014 06:10:33 GMT

try with you monitor stanza. If the data is already indexed it will not help you anymore. You have to delete the index and re-index the files after clearing the fish bucket at forwarder end.

Re: wrong host

emechler_splunk — Fri, 16 May 2014 06:40:42 GMT

What sourcetype are you assigning? There are built-in sourcetypes (e.g. syslog) that could be overriding the host based on the message content.

Re: wrong host

splunker12er — Fri, 16 May 2014 06:58:38 GMT

Goto the path -

etc\system\local

Edit the below files :

server.conf

[general]
serverName = 10.x.x.x

inputs.conf

[default]
host = 10.x.x.x

After making the changes restart the splunkforwarder service.
If you early forwarded logs to indexer , delete the indexed data for the specific host.
or check for recent changes

Re: wrong host

vinchakov_a — Fri, 16 May 2014 07:36:30 GMT

yes, I use syslog sourcetype

Re: wrong host

vinchakov_a — Fri, 16 May 2014 07:55:41 GMT

and was, the problem was in sourcetype. thnx