All Apps and Add-ons

ACI and origin of event


I am about to set up Splunk in a PCI environment. Therefore I need to know for every event where it comes from. Many inputs seem to be a little difficult from this perspective. For now i just want to deal with cisco ACI.

I have the Cisco ACI app on a heavy forwarder which collects all events and forwards the events to my indexer cluster. All events are there, but every event has the HF as host and the collector script path as source.

That makes it quite hard to compile a list of all hosts, from which i have logs in splunk. I would like to have the origin of the event (not the ACI controller, but the real origin) in the host field.

Is there a way to get the right host into the host field? Or is there any other best practice?

Thanks in advance.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>