I have a inputs.conf with splunktcp-ssl stanza.
The connection_host is equals to "dns".
But I would like it to be "none" for some remote servers (Splunk UF sending to this splunktcp-ssl).
Is it possible to keep only one splunk-TCP port open with 2 differents behavior on "connection_host" depending on which IP is sending data? (by tuning "acceptFrom" maybe)
Normally the host is set at the initial forwarder receiving the data, not at a secondary forwarder or the indexer receiving the data on a splunktcp input. The connection_host setting only has an effect if the original forwarder did not set the host field.
Can you perhaps elaborate your situation a bit and why you are using this setting on a splunktcp input? Perhaps that can point us into directions to solve it 🙂
Hi Frank, are you sure that connectionhost has no effect if the original forwarder set host field already?
Because I used to have connectionhost= dns and I had a lot of DNS request by this intermediate forwarder even though all my original UF have got the host field set...
That's how I interpret the inputs.conf spec:
connection_host = [ip|dns|none] * For splunktcp, the host or connection_host will be used if the remote Splunk instance does not set a host, or if the host is set to "<host>::<localhost>".
Not sure how Splunk exactly works, it may still do the DNS lookup, but then decide not to use the result?
Are you trying to filter events and take data only for particular events?Then refer this link:
Also refer this link for hostname:
Let me know if this helps!!