How to forward data with splunk server name inside

[pmelchiori]

I have four servers in different network with the same Windows Name. I've created a Splunk collector and the logs are collected inside it.

My problem is that I can't split the events!

How can I do to split them in different search?

[gkanapathy]

You may wish to use a fully-qualified hostname. If this is absolutely impossible, you can add a key and index another field into Splunk:

inputs.conf where the inputs are being collected:

newfield = network_id

props.conf on the parsing queue machine(s):

[<host or source or sourcetype specifier>]
TRANSFORMS-setnewfieldtonetworkid = setnetworkid

transforms.conf on the parsing queue machine(s):

[setnetworkid]
SOURCE_KEY = newfield
REGEX = (.*)
FORMAT = newfield::$1

fields.conf on the searcher machine:

[newfield]
INDEXED = True
INDEXED_VALUE = False

[the_wolverine · Accepted solution]

You can configure the hostname per Splunk instance. You'll need to update the $SPLUNK_HOME/etc/system/local/inputs.conf to reflect this:

[default]
host = Windows1

Without customizing this, Splunk will use the System's local hostname as its default host setting which, in your case, would be the same for all 4 hosts.

[pmelchiori]

Thanks, it works!

[pmelchiori]

Thanks! I'll try this soon, but why Splunk can't get the name insert in the web interface?