Getting Data In

Changing host for syslog

a212830
Champion

Hi,

I have syslog messages coming in from thousands of servers, and I'm using splunk to index those messages. The messages are duplicated across 3 regional servers. I need the ability to show the forwarder that processed the event. How do I do that, since I change the hostname to be the network device?

Tags (3)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

You can utilize props and transforms to grab the host metadata, before it is changed and assign it to a new field. Here is an example:

# -- props.conf
[sourcetype]
TRANSFORMS-fwd_host = forwarder_host

# -- transforms.conf
[forwarder_host]
SOURCE_KEY = MetaData:Host
REGEX = host::(.*)
DEST_KEY = _meta
FORMAT = forwarder::$1

View solution in original post

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

You can utilize props and transforms to grab the host metadata, before it is changed and assign it to a new field. Here is an example:

# -- props.conf
[sourcetype]
TRANSFORMS-fwd_host = forwarder_host

# -- transforms.conf
[forwarder_host]
SOURCE_KEY = MetaData:Host
REGEX = host::(.*)
DEST_KEY = _meta
FORMAT = forwarder::$1
0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...