Getting Data In

Can I set a different connection_host value for a specific set of remote servers?



I have a inputs.conf with splunktcp-ssl stanza.
The connection_host is equals to "dns".
But I would like it to be "none" for some remote servers (Splunk UF sending to this splunktcp-ssl).

Is it possible to keep only one splunk-TCP port open with 2 differents behavior on "connection_host" depending on which IP is sending data? (by tuning "acceptFrom" maybe)


0 Karma

Ultra Champion

Normally the host is set at the initial forwarder receiving the data, not at a secondary forwarder or the indexer receiving the data on a splunktcp input. The connection_host setting only has an effect if the original forwarder did not set the host field.

Can you perhaps elaborate your situation a bit and why you are using this setting on a splunktcp input? Perhaps that can point us into directions to solve it 🙂

0 Karma


Hi Frank, are you sure that connection_host has no effect if the original forwarder set host field already?
Because I used to have connection_host= dns and I had a lot of DNS request by this intermediate forwarder even though all my original UF have got the host field set...

0 Karma

Ultra Champion

That's how I interpret the inputs.conf spec:

connection_host = [ip|dns|none]
* For splunktcp, the host or connection_host will be used if the remote Splunk
  instance does not set a host, or if the host is set to "<host>::<localhost>".

Not sure how Splunk exactly works, it may still do the DNS lookup, but then decide not to use the result?

0 Karma



Are you trying to filter events and take data only for particular events?Then refer this link:

Also refer this link for hostname:

Let me know if this helps!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!