Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA

[darkwall]

The host shows the hostname of my Syslog server instead of the real hostname from the ASA.

When I try keephostname(yes) in syslog0ng nothing changes...
I try the hostsegment=4 No difference.
Any help would be appreciated.

Inputs.conf in /opt/spl.../etc/system/local.conf
[default]
host = XXXXXSYSLOG

[monitor:///var/log/splunk/barracuda.log}
sourcetype=barracuda:spamfw
index = barracuda

[monitor:///var/log/splunk/asa.log}
sourcetype = cisco:asa
index = asa
**host_segment = 4**

SYSLOG-NG Config

options {
  flush_lines(100);
  time_reopen(10);
  log_fifo_size(1000);
  chain_hostnames(yes);
  use_dns(no);
  use_fqdn(yes);g
  create_dirs(yes);
  keep_hostname(yes);
  threaded(yes);
  };

Thank you.

[gcusello · Accepted solution]

Hi darkwall,
the hostname you usually have is configured in the input.
If you use the UI, in the second page, you can choose the way to identify host:

• IP,
• DNS,
• Custom.

So, if you want a different value, you can configure it here.

If instead you want to read the hostname in logs, you have to configure your Indexers (or Heavy Forwarders if present) to override host value using a regex: to do this see https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Overridedefaulthostassignments

Bye.
Giuseppe

[darkwall]

Hi Giuseppe,

Thank for your quick answer... after reading the docuement.

Yes i need to read the host in the logs after checking the links that you send me everything looks fine now
create/modify transforms.conf and props.conf the make it work.

Thanks a lot...

DarkWall

[gcusello]

Hi darkwall,
if you're satisfied by this answer, please accept and/or upvote it.
Bye.
Giuseppe