How to force the host with syslog sourcetype

yannK — Wed, 20 Feb 2013 18:46:46 GMT

This is a common issue with the syslog sourceytype.
By default it behave differently from the other inputs, the host is extracted from the events.

#inputs.conf

[monitor:///var/log/messages] sourcetype=syslog host=myhostname

with the events :
Feb 19 22:06:35 10.21.24.612 INFO I am a fabulous server

The final host will be 10.21.24.612 not myhostname

I want to change the behavior.

Re: How to force the host with syslog sourcetype

yannK — Wed, 20 Feb 2013 18:49:55 GMT

The solution is to force the host in the inputs.conf and use another sourcetype than syslog without host extraction

define the desired host in the inputs.conf (of the default ones in the $SPLUNK_HOME/etc/system/local/inputs.conf).
apply this sourcetype syslog_nohost at the forwarder level in inputs.conf
define this props.conf on the indexers
if needed you can also define a sourcetype renaming at search time to transparently rename syslog_nohost to syslog, see manager > fields > sourcetype renaming

example
# inputs.conf on the forwarder [monitor:///var/log/messages] sourcetype=syslog_nohost host=myhostiwanttoenforce

# props.conf on the indexers [syslog_nohost] #based on a copy of syslog version 5.0.2 #TRANSFORMS = syslog-host #disabling the host extraction TRANSFORMS = pulldown_type = true maxDist = 3 TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 32 REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False

topic Re: How to force the host with syslog sourcetype in Getting Data In

How to force the host with syslog sourcetype

Re: How to force the host with syslog sourcetype