topic Re: Can I set a different connection_host value for a specific set of remote servers? in Getting Data In

Can I set a different connection_host value for a specific set of remote servers?

ctaf — Thu, 15 Mar 2018 13:56:38 GMT

Hi,

I have a inputs.conf with splunktcp-ssl stanza.
The connection_host is equals to "dns".
But I would like it to be "none" for some remote servers (Splunk UF sending to this splunktcp-ssl).

Is it possible to keep only one splunk-TCP port open with 2 differents behavior on "connection_host" depending on which IP is sending data? (by tuning "acceptFrom" maybe)

Thanks

Re: Can I set a different connection_host value for a specific set of remote servers?

deepashri_123 — Mon, 09 Apr 2018 08:28:49 GMT

Hey@ctaf,

Are you trying to filter events and take data only for particular events?Then refer this link:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

Also refer this link for hostname:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Setadefaulthostforaninput

Let me know if this helps!!

Re: Can I set a different connection_host value for a specific set of remote servers?

FrankVl — Mon, 09 Apr 2018 08:55:21 GMT

Normally the host is set at the initial forwarder receiving the data, not at a secondary forwarder or the indexer receiving the data on a splunktcp input. The connection_host setting only has an effect if the original forwarder did not set the host field.

Can you perhaps elaborate your situation a bit and why you are using this setting on a splunktcp input? Perhaps that can point us into directions to solve it 🙂

Re: Can I set a different connection_host value for a specific set of remote servers?

ctaf — Tue, 29 Sep 2020 18:57:09 GMT

Hi Frank, are you sure that connection_host has no effect if the original forwarder set host field already?
Because I used to have connection_host= dns and I had a lot of DNS request by this intermediate forwarder even though all my original UF have got the host field set...

Re: Can I set a different connection_host value for a specific set of remote servers?

FrankVl — Mon, 09 Apr 2018 10:55:15 GMT

That's how I interpret the inputs.conf spec:

connection_host = [ip|dns|none]
* For splunktcp, the host or connection_host will be used if the remote Splunk
  instance does not set a host, or if the host is set to "<host>::<localhost>".

Not sure how Splunk exactly works, it may still do the DNS lookup, but then decide not to use the result?