Can I set a different connection_host value for a specific set of remote servers?

[ctaf]

Hi,

I have a inputs.conf with splunktcp-ssl stanza.
The connection_host is equals to "dns".
But I would like it to be "none" for some remote servers (Splunk UF sending to this splunktcp-ssl).

Is it possible to keep only one splunk-TCP port open with 2 differents behavior on "connection_host" depending on which IP is sending data? (by tuning "acceptFrom" maybe)

Thanks

[FrankVl]

Normally the host is set at the initial forwarder receiving the data, not at a secondary forwarder or the indexer receiving the data on a splunktcp input. The connection_host setting only has an effect if the original forwarder did not set the host field.

Can you perhaps elaborate your situation a bit and why you are using this setting on a splunktcp input? Perhaps that can point us into directions to solve it 🙂

[ctaf]

Hi Frank, are you sure that connection_host has no effect if the original forwarder set host field already?
Because I used to have connection_host= dns and I had a lot of DNS request by this intermediate forwarder even though all my original UF have got the host field set...

[FrankVl]

That's how I interpret the inputs.conf spec:

connection_host = [ip|dns|none]
* For splunktcp, the host or connection_host will be used if the remote Splunk
  instance does not set a host, or if the host is set to "<host>::<localhost>".

Not sure how Splunk exactly works, it may still do the DNS lookup, but then decide not to use the result?

[deepashri_123]

Hey@ctaf,

Are you trying to filter events and take data only for particular events?Then refer this link:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Discard_specific_e...

Also refer this link for hostname:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Setadefaulthostforaninput

Let me know if this helps!!