All Apps and Add-ons

Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA

darkwall
New Member

The host shows the hostname of my Syslog server instead of the real hostname from the ASA.

When I try keephostname(yes) in syslog0ng nothing changes...
I try the hostsegment=4 No difference.
Any help would be appreciated.

Inputs.conf in /opt/spl.../etc/system/local.conf
[default]
host = XXXXXSYSLOG

[monitor:///var/log/splunk/barracuda.log}
sourcetype=barracuda:spamfw
index = barracuda

[monitor:///var/log/splunk/asa.log}
sourcetype = cisco:asa
index = asa
**host_segment = 4**

SYSLOG-NG Config

options {
  flush_lines(100);
  time_reopen(10);
  log_fifo_size(1000);
  chain_hostnames(yes);
  use_dns(no);
  use_fqdn(yes);g
  create_dirs(yes);
  keep_hostname(yes);
  threaded(yes);
  };

Thank you.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi darkwall,
the hostname you usually have is configured in the input.
If you use the UI, in the second page, you can choose the way to identify host:

  • IP,
  • DNS,
  • Custom.

So, if you want a different value, you can configure it here.

If instead you want to read the hostname in logs, you have to configure your Indexers (or Heavy Forwarders if present) to override host value using a regex: to do this see https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Overridedefaulthostassignments

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi darkwall,
the hostname you usually have is configured in the input.
If you use the UI, in the second page, you can choose the way to identify host:

  • IP,
  • DNS,
  • Custom.

So, if you want a different value, you can configure it here.

If instead you want to read the hostname in logs, you have to configure your Indexers (or Heavy Forwarders if present) to override host value using a regex: to do this see https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Overridedefaulthostassignments

Bye.
Giuseppe

0 Karma

darkwall
New Member

Hi Giuseppe,

Thank for your quick answer... after reading the docuement.

Yes i need to read the host in the logs after checking the links that you send me everything looks fine now
create/modify transforms.conf and props.conf the make it work.

Thanks a lot...

DarkWall

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi darkwall,
if you're satisfied by this answer, please accept and/or upvote it.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...