https://community.splunk.com/t5/Getting-Data-In/Changing-host-for-syslog/m-p/48913#M9280 <P>You can utilize props and transforms to grab the host metadata, before it is changed and assign it to a new field. Here is an example:</P> <PRE><CODE># -- props.conf [sourcetype] TRANSFORMS-fwd_host = forwarder_host # -- transforms.conf [forwarder_host] SOURCE_KEY = MetaData:Host REGEX = host::(.*) DEST_KEY = _meta FORMAT = forwarder::$1 </CODE></PRE> Thu, 29 Nov 2012 14:41:28 GMT sbrant_splunk 2012-11-29T14:41:28Z https://community.splunk.com/t5/Getting-Data-In/Changing-host-for-syslog/m-p/48912#M9279 <P>Hi,</P> <P>I have syslog messages coming in from thousands of servers, and I'm using splunk to index those messages. The messages are duplicated across 3 regional servers. I need the ability to show the forwarder that processed the event. How do I do that, since I change the hostname to be the network device? </P> Thu, 29 Nov 2012 14:36:59 GMT https://community.splunk.com/t5/Getting-Data-In/Changing-host-for-syslog/m-p/48912#M9279 a212830 2012-11-29T14:36:59Z https://community.splunk.com/t5/Getting-Data-In/Changing-host-for-syslog/m-p/48913#M9280 <P>You can utilize props and transforms to grab the host metadata, before it is changed and assign it to a new field. Here is an example:</P> <PRE><CODE># -- props.conf [sourcetype] TRANSFORMS-fwd_host = forwarder_host # -- transforms.conf [forwarder_host] SOURCE_KEY = MetaData:Host REGEX = host::(.*) DEST_KEY = _meta FORMAT = forwarder::$1 </CODE></PRE> Thu, 29 Nov 2012 14:41:28 GMT https://community.splunk.com/t5/Getting-Data-In/Changing-host-for-syslog/m-p/48913#M9280 sbrant_splunk 2012-11-29T14:41:28Z