https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-an-indexer-s-IP-address-for-output-on/m-p/190998#M38023 <P>Hi,</P> <P>Is there a way to use the IP address of the indexer on the universal forwarder but have the name of the host displayed on the indexer ??</P> <P>Here is my configuration :</P> <P>[tcpout]<BR /> defaultGroup = indexer-group</P> <P>[tcpout:indexer-group]<BR /> maxQueueSize = auto<BR /> server = 172.44.23.114:9997</P> <P>[tcpout-server://172.44.23.114:9997]</P> <P>Meaning that on my index it would show "prod-log-server" (the hostname) instead of 172.44.23.114</P> Thu, 21 Aug 2014 21:06:20 GMT splunkmasterfle 2014-08-21T21:06:20Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-an-indexer-s-IP-address-for-output-on/m-p/190998#M38023 <P>Hi,</P> <P>Is there a way to use the IP address of the indexer on the universal forwarder but have the name of the host displayed on the indexer ??</P> <P>Here is my configuration :</P> <P>[tcpout]<BR /> defaultGroup = indexer-group</P> <P>[tcpout:indexer-group]<BR /> maxQueueSize = auto<BR /> server = 172.44.23.114:9997</P> <P>[tcpout-server://172.44.23.114:9997]</P> <P>Meaning that on my index it would show "prod-log-server" (the hostname) instead of 172.44.23.114</P> Thu, 21 Aug 2014 21:06:20 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-an-indexer-s-IP-address-for-output-on/m-p/190998#M38023 splunkmasterfle 2014-08-21T21:06:20Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-an-indexer-s-IP-address-for-output-on/m-p/190999#M38024 <P>The indexer address used in <CODE>outputs.conf</CODE> is unrelated to any hosts set in <CODE>inputs.conf</CODE> (or overridden in <CODE>transforms.conf</CODE>... so yes, there is a way - nothing's in your way in fact.</P> Thu, 21 Aug 2014 22:14:37 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-an-indexer-s-IP-address-for-output-on/m-p/190999#M38024 martin_mueller 2014-08-21T22:14:37Z