topic Syslog server "host" field question in Getting Data In

Syslog server "host" field question

adamblock2 — Wed, 13 Jan 2016 16:55:31 GMT

The Splunk documentation defines “host” as being “an event host value is typically the hostname, IP address, or fully qualified domain name of the network host from which the event originated.” In the case of a syslog server, is it best for the “host” field to contain the hostname of the syslog server, or could/should it contain the hostname of the host where the events are generated?

Re: Syslog server "host" field question

somesoni2 — Wed, 13 Jan 2016 17:07:45 GMT

Syslog server will be an intermediate location between Splunk and actual server where events were generated. I would use the hostname of the server where events where generated (this should be logged within each event data itself) as host field, mostly using a transforms.conf to overwrite metadata field host.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/overridedefaulthostassignments

Re: Syslog server "host" field question

woodcock — Thu, 14 Jan 2016 16:07:18 GMT

The host field should absolutely be the place where the event occurred and not anything else in the delivery pipeline to splunk.