Getting Data In

Cannot change host field in syslog data

sunrise
Contributor

Hi Splunkers,

I collect syslog(/var/log/messages) data by Universal Forwarder, not UDP like this.
Sep 3 12:42:16 ip-111-111-111-111 dhclient: bound to 111.111.111.111 -- renewal in 1414 seconds.

And I want to get this host field as FQDN "myhost", but I cannot do this.
Configuration files in indexers as following.

inputs.conf
[monitor:///var/log/messages]
index = mysyslog
host = myhost

props.conf
[host::ip-111-111-111-111]
TRANSFORMS-t1 = rename_myhost

transforms.conf
[rename_myhost]
REGEX = ^.*$
DEST_KEY = MetaData:Host
FORMAT = host::myhost

How can I will do this ?

Thank you for your help.

1 Solution

HiroshiSatoh
Champion

inputs.confでhostを指定するのではダメですか?

例)
[monitor:///var/log/messages]
disabled = false
sourcetype = syslog
host = myhost

View solution in original post

HiroshiSatoh
Champion

inputs.confでhostを指定するのではダメですか?

例)
[monitor:///var/log/messages]
disabled = false
sourcetype = syslog
host = myhost

kristian_kolb
Ultra Champion

The problem is that while host=myhost is set in the input phase, data with the syslog sourcetype will be sent to a transform that rewrites the hostname to whatever comes after the timestamp in each event.

If you change the sourcetype to something other than syslog this host override will not happen.

/k

saurabh_tek11
Communicator

@sunrise, @HiroshiSatoh @kristian.kolb Still it is unclear to me what would be correct settings in inputs, props and transforms.conf

is this correct ??
please correct me if i am not getting it right. Thanks for help!

inputs.conf
[monitor:///var/log/messages]
index = mysyslog
disabled = false
sourcetype = syslog
host = myhost

props.conf
[syslog]
TRANSFORMS-t1 = rename_myhost

transforms.conf
[rename_myhost]
REGEX = ^.*$
DEST_KEY = MetaData:Host
FORMAT = host::myhost
0 Karma

micahkemp
Champion

The above looks correct, but there is already a TRANSFORMS = syslog-host defined by default for the syslog sourcetype, which might occur after your transform, thus rewriting the host field again based on the contents of the syslog message.

0 Karma

sunrise
Contributor

No I cannot do by that way.
I've already set host=myhost in inputs.conf file.

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...