I am about to set up Splunk in a PCI environment. Therefore I need to know for every event where it comes from. Many inputs seem to be a little difficult from this perspective. For now i just want to deal with cisco ACI.
I have the Cisco ACI app on a heavy forwarder which collects all events and forwards the events to my indexer cluster. All events are there, but every event has the HF as host and the collector script path as source.
That makes it quite hard to compile a list of all hosts, from which i have logs in splunk. I would like to have the origin of the event (not the ACI controller, but the real origin) in the host field.
Is there a way to get the right host into the host field? Or is there any other best practice?
Thanks in advance.
