All Apps and Add-ons

Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA

darkwall
New Member

The host shows the hostname of my Syslog server instead of the real hostname from the ASA.

When I try keephostname(yes) in syslog0ng nothing changes...
I try the hostsegment=4 No difference.
Any help would be appreciated.

Inputs.conf in /opt/spl.../etc/system/local.conf
[default]
host = XXXXXSYSLOG

[monitor:///var/log/splunk/barracuda.log}
sourcetype=barracuda:spamfw
index = barracuda

[monitor:///var/log/splunk/asa.log}
sourcetype = cisco:asa
index = asa
**host_segment = 4**

SYSLOG-NG Config

options {
  flush_lines(100);
  time_reopen(10);
  log_fifo_size(1000);
  chain_hostnames(yes);
  use_dns(no);
  use_fqdn(yes);g
  create_dirs(yes);
  keep_hostname(yes);
  threaded(yes);
  };

Thank you.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi darkwall,
the hostname you usually have is configured in the input.
If you use the UI, in the second page, you can choose the way to identify host:

  • IP,
  • DNS,
  • Custom.

So, if you want a different value, you can configure it here.

If instead you want to read the hostname in logs, you have to configure your Indexers (or Heavy Forwarders if present) to override host value using a regex: to do this see https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Overridedefaulthostassignments

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi darkwall,
the hostname you usually have is configured in the input.
If you use the UI, in the second page, you can choose the way to identify host:

  • IP,
  • DNS,
  • Custom.

So, if you want a different value, you can configure it here.

If instead you want to read the hostname in logs, you have to configure your Indexers (or Heavy Forwarders if present) to override host value using a regex: to do this see https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Overridedefaulthostassignments

Bye.
Giuseppe

0 Karma

darkwall
New Member

Hi Giuseppe,

Thank for your quick answer... after reading the docuement.

Yes i need to read the host in the logs after checking the links that you send me everything looks fine now
create/modify transforms.conf and props.conf the make it work.

Thanks a lot...

DarkWall

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi darkwall,
if you're satisfied by this answer, please accept and/or upvote it.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...