All Apps and Add-ons

Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA

New Member

The host shows the hostname of my Syslog server instead of the real hostname from the ASA.

When I try keephostname(yes) in syslog0ng nothing changes...
I try the hostsegment=4 No difference.
Any help would be appreciated.

Inputs.conf in /opt/spl.../etc/system/local.conf
[default]
host = XXXXXSYSLOG

[monitor:///var/log/splunk/barracuda.log}
sourcetype=barracuda:spamfw
index = barracuda

[monitor:///var/log/splunk/asa.log}
sourcetype = cisco:asa
index = asa
**host_segment = 4**

SYSLOG-NG Config

options {
  flush_lines(100);
  time_reopen(10);
  log_fifo_size(1000);
  chain_hostnames(yes);
  use_dns(no);
  use_fqdn(yes);g
  create_dirs(yes);
  keep_hostname(yes);
  threaded(yes);
  };

Thank you.

0 Karma
1 Solution

Legend

Hi darkwall,
the hostname you usually have is configured in the input.
If you use the UI, in the second page, you can choose the way to identify host:

  • IP,
  • DNS,
  • Custom.

So, if you want a different value, you can configure it here.

If instead you want to read the hostname in logs, you have to configure your Indexers (or Heavy Forwarders if present) to override host value using a regex: to do this see https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Overridedefaulthostassignments

Bye.
Giuseppe

View solution in original post

0 Karma

Legend

Hi darkwall,
the hostname you usually have is configured in the input.
If you use the UI, in the second page, you can choose the way to identify host:

  • IP,
  • DNS,
  • Custom.

So, if you want a different value, you can configure it here.

If instead you want to read the hostname in logs, you have to configure your Indexers (or Heavy Forwarders if present) to override host value using a regex: to do this see https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Overridedefaulthostassignments

Bye.
Giuseppe

View solution in original post

0 Karma

New Member

Hi Giuseppe,

Thank for your quick answer... after reading the docuement.

Yes i need to read the host in the logs after checking the links that you send me everything looks fine now
create/modify transforms.conf and props.conf the make it work.

Thanks a lot...

DarkWall

0 Karma

Legend

Hi darkwall,
if you're satisfied by this answer, please accept and/or upvote it.
Bye.
Giuseppe

0 Karma