All Apps and Add-ons

Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA

darkwall
New Member

The host shows the hostname of my Syslog server instead of the real hostname from the ASA.

When I try keephostname(yes) in syslog0ng nothing changes...
I try the hostsegment=4 No difference.
Any help would be appreciated.

Inputs.conf in /opt/spl.../etc/system/local.conf
[default]
host = XXXXXSYSLOG

[monitor:///var/log/splunk/barracuda.log}
sourcetype=barracuda:spamfw
index = barracuda

[monitor:///var/log/splunk/asa.log}
sourcetype = cisco:asa
index = asa
**host_segment = 4**

SYSLOG-NG Config

options {
  flush_lines(100);
  time_reopen(10);
  log_fifo_size(1000);
  chain_hostnames(yes);
  use_dns(no);
  use_fqdn(yes);g
  create_dirs(yes);
  keep_hostname(yes);
  threaded(yes);
  };

Thank you.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi darkwall,
the hostname you usually have is configured in the input.
If you use the UI, in the second page, you can choose the way to identify host:

  • IP,
  • DNS,
  • Custom.

So, if you want a different value, you can configure it here.

If instead you want to read the hostname in logs, you have to configure your Indexers (or Heavy Forwarders if present) to override host value using a regex: to do this see https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Overridedefaulthostassignments

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi darkwall,
the hostname you usually have is configured in the input.
If you use the UI, in the second page, you can choose the way to identify host:

  • IP,
  • DNS,
  • Custom.

So, if you want a different value, you can configure it here.

If instead you want to read the hostname in logs, you have to configure your Indexers (or Heavy Forwarders if present) to override host value using a regex: to do this see https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Overridedefaulthostassignments

Bye.
Giuseppe

0 Karma

darkwall
New Member

Hi Giuseppe,

Thank for your quick answer... after reading the docuement.

Yes i need to read the host in the logs after checking the links that you send me everything looks fine now
create/modify transforms.conf and props.conf the make it work.

Thanks a lot...

DarkWall

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi darkwall,
if you're satisfied by this answer, please accept and/or upvote it.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...