topic Re: host lookup in Splunk Search

host lookup

DTERM — Thu, 16 Feb 2012 20:58:37 GMT

I'm getting some unexpected results when I run the following query for hosts:

index=mydata | top host

I expect to see a list of the top hosts in my index however I get back information such as eth0, eth1, sit0, sum, etc in my hosts column. This data is not accurate. When I click on one of the host fields to see get more information about the source, I see...

host=0.00 sourcetype=syslog source=/var/log/sa/sar15

What is causing this, and more importantly, how to stop it? Thanks in advance!

Re: host lookup

Damien_Dallimor — Thu, 16 Feb 2012 21:05:27 GMT

It looks like you a monitoring a file....how are you specifying your host field extraction ?

Re: host lookup

DTERM — Thu, 16 Feb 2012 21:13:19 GMT

I love the MARSHALL back ground!! Excellent. Regarding the host field extraction, how do I answer that? What file holds that information?

Re: host lookup

MHibbin — Thu, 16 Feb 2012 21:36:54 GMT

To jump in, you should look at the inputs.conf file and "host_regex" option. So is "sar15" the host?

Re: host lookup

Damien_Dallimor — Thu, 16 Feb 2012 21:39:14 GMT

Correct , and there is also a "host_segment" option to consider.

Re: host lookup

DTERM — Thu, 16 Feb 2012 22:01:50 GMT

[monitor:///var/log]
sourcetype = syslog
disabled = false
host = myhost

That is a paragraph in my inputs.conf file. Do I just need to remove that entire paragraph?

Thanks,

Re: host lookup

Damien_Dallimor — Mon, 28 Sep 2020 11:24:50 GMT

I would change the sourcetype to something else.
ie: "my_log_file"

By using the "syslog" sourcetype , the default syslog host field transforms are getting invoked on your events.

That's why your host field is getting filled incorrectly.

from etc/system/default

props.conf

[syslog]
...
TRANSFORMS = syslog-host
...

transforms.conf

[syslog-host]
DEST_KEY = MetaData:Host
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(\w[\w.-]{2,})]?\s
FORMAT = host::$1

Re: host lookup

DTERM — Tue, 21 Feb 2012 20:59:27 GMT

sar15 is not the host, just FYI... 🙂