Deployment Architecture

How to forward data with splunk server name inside

pmelchiori
Explorer

I have four servers in different network with the same Windows Name. I've created a Splunk collector and the logs are collected inside it.

My problem is that I can't split the events!

How can I do to split them in different search?

Tags (2)
1 Solution

the_wolverine
Champion

You can configure the hostname per Splunk instance. You'll need to update the $SPLUNK_HOME/etc/system/local/inputs.conf to reflect this:

[default]
host = Windows1

Without customizing this, Splunk will use the System's local hostname as its default host setting which, in your case, would be the same for all 4 hosts.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You may wish to use a fully-qualified hostname. If this is absolutely impossible, you can add a key and index another field into Splunk:

inputs.conf where the inputs are being collected:

newfield = network_id

props.conf on the parsing queue machine(s):

[<host or source or sourcetype specifier>]
TRANSFORMS-setnewfieldtonetworkid = setnetworkid

transforms.conf on the parsing queue machine(s):

[setnetworkid]
SOURCE_KEY = newfield
REGEX = (.*)
FORMAT = newfield::$1

fields.conf on the searcher machine:

[newfield]
INDEXED = True
INDEXED_VALUE = False

the_wolverine
Champion

You can configure the hostname per Splunk instance. You'll need to update the $SPLUNK_HOME/etc/system/local/inputs.conf to reflect this:

[default]
host = Windows1

Without customizing this, Splunk will use the System's local hostname as its default host setting which, in your case, would be the same for all 4 hosts.

pmelchiori
Explorer

Thanks, it works!

0 Karma

pmelchiori
Explorer

Thanks! I'll try this soon, but why Splunk can't get the name insert in the web interface?

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...