I've been running Splunk 4 for about 2 years now, and I've been feeding it using syslog-ng to aggregate and filter incoming logs from remote hosts. This worked wonderfully, as long as we used the "keep_hostname(yes)" option in syslog-ng.
Now that I've upgraded to Splunk 5, Splunk appears to be setting the hostname field in search to the hostname of the log aggregator, not the original host. So now I've got 3 sets of timestamps, 2 hostnames in the log message itself, and an incorrect host field extraction.
How can I get Splunk to properly handle relayed syslog data, and properly extract the fields from the logs?