Getting Data In

Change hostname for syslog sourcetype ?

frankejj
Explorer

Hi,

I am trying to override the default hostname that is being set for the syslog entries on /var/log/messages. These are the only entries that are being indexed with 'hostname' instead of 'hostname.fqdn'

I have tried the following:
   $SPLUNKHOME/etc/system/local/props.conf:
      [syslog]
      TRANSFORMS =

RESULT: No difference

   $SPLUNKHOME/etc/system/local/props.conf:
     [source::/var/log/messages]
     # note: overriding default syslog transform!
     TRANSFORMS = something

   $SPLUNKHOME/etc/system/local/transforms.conf
     [something]
     DEST_KEY = MetaData:Host
     REGEX = .
     FORMAT = host::hostname.fqdn

RESULT: No difference

Am I missing something?

Thanks, John

0 Karma
1 Solution

Lowell
Super Champion

You realize that once the events are indexed they will not be changed by any configuration change. You will have to restart, and then only newly loaded events will have any change.

Otherwise, it looks like what you are trying should work.

Update:

The one thing I'm not sure about is exactly how the TRANSFORMS is being overwritten. The default config for syslog, which I'm assuming it the sourcetype you are using, uses the "syslog-host" transformer to extract the "host" value from the event text. Of the top of my head, I'm not sure which setting should win in a source vs sourcetype matching precedent like this (normally I try to avoid this kind of conflict.) Using btool and splunk test sourcetype /var/log/messages could be shed some light on the situation.


Related answers:

View solution in original post

0 Karma

Lowell
Super Champion

You realize that once the events are indexed they will not be changed by any configuration change. You will have to restart, and then only newly loaded events will have any change.

Otherwise, it looks like what you are trying should work.

Update:

The one thing I'm not sure about is exactly how the TRANSFORMS is being overwritten. The default config for syslog, which I'm assuming it the sourcetype you are using, uses the "syslog-host" transformer to extract the "host" value from the event text. Of the top of my head, I'm not sure which setting should win in a source vs sourcetype matching precedent like this (normally I try to avoid this kind of conflict.) Using btool and splunk test sourcetype /var/log/messages could be shed some light on the situation.


Related answers:

0 Karma

frankejj
Explorer

Thanks for the answer - using the related questions helped a lot. Also key piece of info was that SplunkLightForwarders do not apply transforms. The transforms get applied on the indexer.

0 Karma

frankejj
Explorer

Yes, I realize this. Even after the changes above the new syslog entries are still being indexed as hostname not as hostname.fqdn as I would expect.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...