Archive2

when set no_priority_stripping = true the host change

matoulas
Path Finder

Hi,

when I set no_priority_stripping = true the host change from IP Address to Host name when performing a search in splunk. Example Host="10.10.10.170" to Host="ABC-DEVICE"

Before set no_priority_stripping = true in inputs.conf

Below is syslog event send to splunk

2:31:50.000 PM

<134> 1 2019-11-15T14:31:50-08:00 ABC-DEVICE server - - [meta sequenceId="13" enterpriseId="2634.1.17.16" vendorId="WTI"] CPM: ABC-DEVICE, (AUDIT LOG) DATE-TIME: 11/15/19 14:31:50
host = ABC-DEVICE source = udp:514 sourcetype = syslog

After remove set no_priority_stripping = true from inputs.conf

Nov 15 14:07:57 192.168.100.170 1 2019-11-15T14:07:57-08:00 ABC-DEVICE server - - [meta sequenceId="8" enterpriseId="2634.1.17.16" vendorId="WTI"] CPM: ANTHONY-TEST, (AUDIT LOG) DATE-TIME: 11/15/19 14:07:57,
host = 10.10.10.170 source = udp:514 sourcetype = syslog

Anyone have any idea why Splunk Stripping the IP Address and replace it with the Host name instead.

Tags (1)
0 Karma
Reply
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!