https://community.splunk.com/t5/Getting-Data-In/How-to-disable-hostname-chaining/m-p/10612#M385 <P>There are two alternative solutions for this issue: &gt;</P> <BLOCKQUOTE> <OL> <LI><P>Modify the configuration of syslog server to disable hostname chaining. This is the preferred method since it removes one of the moving parts in this equation and ensures that events being sourceypted as syslog that do not have a chained hostname are not impacted Below is a link for syslog-ng.conf reference: <A href="http://linux.die.net/man/5/syslog-ng.conf" rel="nofollow">http://linux.die.net/man/5/syslog-ng.conf</A> Look for "chain_hostnames"</P></LI> <LI><P>Create a props.conf file under your $SPLUNK_HOME/etc/apps/SplunkEnterrpiseSecuritySuite/local with below content:</P></LI> </OL> <P>[syslog] TRANSFORMS = syslog-header-stripper-ts-host, syslog-host</P> <P>This will tell Splunk to remove the the chained hostname and timestamp from the event and then extract the hostname from the newly modified event.</P> </BLOCKQUOTE> Sat, 27 Mar 2010 05:22:15 GMT zliu 2010-03-27T05:22:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-disable-hostname-chaining/m-p/10611#M384 <P>How to disable hostname chaining? Splunk picks the chained hostname rather than the original.</P> Sat, 27 Mar 2010 05:19:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-disable-hostname-chaining/m-p/10611#M384 zliu 2010-03-27T05:19:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-disable-hostname-chaining/m-p/10612#M385 <P>There are two alternative solutions for this issue: &gt;</P> <BLOCKQUOTE> <OL> <LI><P>Modify the configuration of syslog server to disable hostname chaining. This is the preferred method since it removes one of the moving parts in this equation and ensures that events being sourceypted as syslog that do not have a chained hostname are not impacted Below is a link for syslog-ng.conf reference: <A href="http://linux.die.net/man/5/syslog-ng.conf" rel="nofollow">http://linux.die.net/man/5/syslog-ng.conf</A> Look for "chain_hostnames"</P></LI> <LI><P>Create a props.conf file under your $SPLUNK_HOME/etc/apps/SplunkEnterrpiseSecuritySuite/local with below content:</P></LI> </OL> <P>[syslog] TRANSFORMS = syslog-header-stripper-ts-host, syslog-host</P> <P>This will tell Splunk to remove the the chained hostname and timestamp from the event and then extract the hostname from the newly modified event.</P> </BLOCKQUOTE> Sat, 27 Mar 2010 05:22:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-disable-hostname-chaining/m-p/10612#M385 zliu 2010-03-27T05:22:15Z