Adding Value to Host=

sdagostino — Thu, 10 Jun 2010 01:41:00 GMT

Is there a way in Splunk to add a description (type of device ie Nortel 8600) or replace the Host IP address with the equipment type or location. See search string below.

1:40:03.000 PM Jun 9 13:40:03 10.254.4.6 19263 06/09/2010 12:42:32 Syslog 0 : Failed Login Attempt: Username=69.193.186.46: Date/Time=06/09/2010 12:42:32

host=10.x.x.6 Options sourcetype=syslog Options source=udp:514 Options timestartpos=0 Options timeendpos=15 Options

Re: Adding Value to Host=

Genti — Fri, 11 Jun 2010 00:01:20 GMT

so, it seems to me like you are monitoring a UDP port.
Go to:

Manager » Data inputs » UDP »

And edit your UDP configuration. On the HOST section, choose Custom, and set the custom hostname, or location of the machine, or the type of device..etc.

Note that there might be a bug that prevents this from working, a small flag doesnt get set. A secure way to achieve what you want is to actually edit the inputs.conf file manually.

Find your monitor stanza for your UDP source it and edit it, it should look something like this:

[udp://514]
host = Nortel8600
sourcetype = udppackets
connection_host = none

Cheers,
.gz

topic Re: Adding Value to Host= in Splunk Search

Adding Value to Host=

Re: Adding Value to Host=