https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301571#M56983 <P>@pil321 did you set the host_segment inside of your inputs.conf? I would think it would default to the actual UF device if one isn't designated, but it could be possible it doesn't.</P> Fri, 25 Aug 2017 14:06:49 GMT Grumpalot 2017-08-25T14:06:49Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301570#M56982 <P>I'm currently forwarding all network device logs (syslog) from a syslog server (rsyslog - running on RHEL 7) to an indexer via universal forwarder (UF). The logs are making it to the indexer (index=syslog), but under 'selected fields' on the 'search &amp; reporting' app no host name is being shown (?), just source and sourcetype.</P> <P>Has anyone ever seen anything like this?</P> Fri, 25 Aug 2017 13:17:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301570#M56982 pil321 2017-08-25T13:17:08Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301571#M56983 <P>@pil321 did you set the host_segment inside of your inputs.conf? I would think it would default to the actual UF device if one isn't designated, but it could be possible it doesn't.</P> Fri, 25 Aug 2017 14:06:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301571#M56983 Grumpalot 2017-08-25T14:06:49Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301572#M56984 <P>You can update which fields come under section 'selected fields'. Click on 'All fields' link on top of field sidebar, then select the checkbox against the fields that you want to show in selected fields.</P> Fri, 25 Aug 2017 14:56:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301572#M56984 somesoni2 2017-08-25T14:56:23Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301573#M56985 <P>thanks for the reply @Grumpalot - it's set (host_segment = 3).</P> Fri, 25 Aug 2017 15:16:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301573#M56985 pil321 2017-08-25T15:16:50Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301574#M56986 <P>Wow! It was that simple! I've never seen it do this before though - it usually just defaults to that.</P> <P>Thanks @somesoni2!</P> Fri, 25 Aug 2017 15:18:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301574#M56986 pil321 2017-08-25T15:18:49Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301575#M56987 <P>Glad it worked out for you. Do remember to close the question so that any future reader with similar issue can reference it.</P> Fri, 25 Aug 2017 15:30:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301575#M56987 somesoni2 2017-08-25T15:30:08Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301576#M56988 <P>Will do. Thanks again!</P> Fri, 25 Aug 2017 15:34:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-show-the-host-values-under-selected-fields-for-syslog/m-p/301576#M56988 pil321 2017-08-25T15:34:35Z