topic Re: Host in Props.conf Not Working in Getting Data In

Host in Props.conf Not Working

skoelpin — Tue, 12 May 2015 15:54:33 GMT

I need to lengthen the lines in my events so I went into Splunk\etc\system\local\props.conf and added

[SRV-DCP01UVWS01]
TRUNCATE = 20000 
MAX_EVENTS = 20000

It is not seeing the host, but if I change it from the host to the source [ATG_Message_Log]then it will work correctly. I DO NOT want to use the source as it will affect other logging. I want to use the host

This is a new host, do I have to define the host somewhere in Splunk so it can recognize it?

Re: Host in Props.conf Not Working

jtrucks — Tue, 12 May 2015 16:18:48 GMT

Check if the host uses FQDN or is coming from that source as an IP not a hostname. Your host stanza has to match how it looks in the data source. Consider wildcards if you have FQDN and non-FQDN, too.

Re: Host in Props.conf Not Working

woodcock — Tue, 12 May 2015 16:25:40 GMT

You have almost certainly done a host-override so you need to use the original host value, not your modified/overridden host value. You could also use sourcetype in props.conf.

Re: Host in Props.conf Not Working

skoelpin — Tue, 12 May 2015 17:07:25 GMT

Thanks for the response. I'm going to do an nslookup on the box to see if I got the host name correct. I will post back if it works

Re: Host in Props.conf Not Working

skoelpin — Tue, 12 May 2015 17:08:20 GMT

Yeah I would agree, it seems to be the only logical answer. I also tried using the sourcetype and still had no luck, it seems like only the Source is working. I'll report back if I misnamed the host

Re: Host in Props.conf Not Working

skoelpin — Tue, 12 May 2015 18:12:26 GMT

I just did an nslookup on that domain and got what matched the data source and it still did not work. I then tried using the IP of the host and still couldn't get that working. The sourcetype also does not work. The only thing which works is the source. Any other ideas? Do I need to define the host somewhere in the inputs.conf?

Re: Host in Props.conf Not Working

somesoni2 — Tue, 12 May 2015 18:21:15 GMT

Not sure if this is relevant, you're setting properties for the data coming from a host, so shouldn't you be using syntax as [host:SRV-DCP01UVWS01]. Also, the hyphen in the host name could also cause it to not work.

Re: Host in Props.conf Not Working

skoelpin — Tue, 12 May 2015 18:42:26 GMT

Thanks for your suggestion. In my original post I said it was only working on the source, but meant to say sourcetype. I was finally able to get it to work by changing the sourcetype in my Splunk forwarder.

Re: Host in Props.conf Not Working

skoelpin — Tue, 12 May 2015 18:42:54 GMT

I finally got it working by changing my sourcetype in the Splunk forwarder on the server I was trying to hit. Thanks for your help

Re: Host in Props.conf Not Working

woodcock — Tue, 12 May 2015 19:08:24 GMT

Be aware that you can rename your sourcetype back to match all of the others so that your searches will work the way they always have like this in props.conf:

[SRV-DCP01UVWS01-unique]
rename SRV-DCP01UVWS01
TRUNCATE = 20000 
MAX_EVENTS = 20000

The benefit of this is that you get your unique changes but you also continue to share a common sourcetype. Futhermore, you can discriminate back out the unique events if you need to by using _sourcetype="SRV-DCP01UVWS01-unique" because _sourcetype is created to contain the original value when you rename sourcetype!

Re: Host in Props.conf Not Working

carlosumbc — Wed, 09 May 2018 13:53:32 GMT

@somesoni2: you mention that the hyphen in the host name could also cause it not to work. What do you mean? We are having an issue where hyphenated hostnames aren't working.