Deployment Architecture

How to forward data with splunk server name inside

pmelchiori
Explorer

I have four servers in different network with the same Windows Name. I've created a Splunk collector and the logs are collected inside it.

My problem is that I can't split the events!

How can I do to split them in different search?

Tags (2)
1 Solution

the_wolverine
Champion

You can configure the hostname per Splunk instance. You'll need to update the $SPLUNK_HOME/etc/system/local/inputs.conf to reflect this:

[default]
host = Windows1

Without customizing this, Splunk will use the System's local hostname as its default host setting which, in your case, would be the same for all 4 hosts.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You may wish to use a fully-qualified hostname. If this is absolutely impossible, you can add a key and index another field into Splunk:

inputs.conf where the inputs are being collected:

newfield = network_id

props.conf on the parsing queue machine(s):

[<host or source or sourcetype specifier>]
TRANSFORMS-setnewfieldtonetworkid = setnetworkid

transforms.conf on the parsing queue machine(s):

[setnetworkid]
SOURCE_KEY = newfield
REGEX = (.*)
FORMAT = newfield::$1

fields.conf on the searcher machine:

[newfield]
INDEXED = True
INDEXED_VALUE = False

the_wolverine
Champion

You can configure the hostname per Splunk instance. You'll need to update the $SPLUNK_HOME/etc/system/local/inputs.conf to reflect this:

[default]
host = Windows1

Without customizing this, Splunk will use the System's local hostname as its default host setting which, in your case, would be the same for all 4 hosts.

pmelchiori
Explorer

Thanks, it works!

0 Karma

pmelchiori
Explorer

Thanks! I'll try this soon, but why Splunk can't get the name insert in the web interface?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...