All Apps and Add-ons

ACI and origin of event


I am about to set up Splunk in a PCI environment. Therefore I need to know for every event where it comes from. Many inputs seem to be a little difficult from this perspective. For now i just want to deal with cisco ACI.

I have the Cisco ACI app on a heavy forwarder which collects all events and forwards the events to my indexer cluster. All events are there, but every event has the HF as host and the collector script path as source.

That makes it quite hard to compile a list of all hosts, from which i have logs in splunk. I would like to have the origin of the event (not the ACI controller, but the real origin) in the host field.

Is there a way to get the right host into the host field? Or is there any other best practice?

Thanks in advance.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...