https://community.splunk.com/t5/Getting-Data-In/How-to-change-the-value-of-host-field-when-receiving-some/m-p/439681#M76685 <P>To do it within Splunk, I think what you want to look at is this: <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Overridedefaulthostassignments">https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Overridedefaulthostassignments</A></P> Wed, 13 Mar 2019 23:37:09 GMT jdsl 2019-03-13T23:37:09Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-the-value-of-host-field-when-receiving-some/m-p/439680#M76684 <P>if I received 20 devices log from a single syslog server , how can I seperate host field to those 20 source of logs instead of my syslog server IP address?</P> Wed, 13 Mar 2019 20:36:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-the-value-of-host-field-when-receiving-some/m-p/439680#M76684 sabaKhadivi 2019-03-13T20:36:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-the-value-of-host-field-when-receiving-some/m-p/439681#M76685 <P>To do it within Splunk, I think what you want to look at is this: <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Overridedefaulthostassignments">https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Overridedefaulthostassignments</A></P> Wed, 13 Mar 2019 23:37:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-the-value-of-host-field-when-receiving-some/m-p/439681#M76685 jdsl 2019-03-13T23:37:09Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-the-value-of-host-field-when-receiving-some/m-p/439682#M76686 <P>This is best done in your syslog server, rather than in Splunk. Have syslog save data in separate files based on the originating system. If you include the source address in the file path, a Splunk forwarder can use that as the host name. See <A href="https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html">https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html</A> for more.</P> Wed, 13 Mar 2019 23:37:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-the-value-of-host-field-when-receiving-some/m-p/439682#M76686 richgalloway 2019-03-13T23:37:16Z