Getting Data In

File Monitor Not Assigning the right host name

hartfoml
Motivator

Here is a portion of my inputs.conf


[monitor:///mnt/log/192.168.100.200/messages]

disabled = false

followTail = 0

host =

host_segment = 3

index = num1

[monitor:///mnt/log/192.168.100.300/messages]

disabled = false

followTail = 0

host = MyFileServer1.local

index = num2

[monitor:///mnt/log/192.168.100.400/messages]

disabled = false

followTail = 0

host = MyFileServer2.local

index = num2


As you can see the first one is using host_segment = 3 to assign a host name based on the monitor path.

The second two use a “Constant Value” to assign the host name

After I put in there values all three are using the segment = 3 to assign the hostname to the logs

I deleted the entries and put them back in as you see above and still the host name for the last two are using the IP as the host name.

What can I do to change this?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Is it possible that your files are syslog style, and Splunk is seeing this and extracting and overwriting the host from the contents of the file?

0 Karma

hartfoml
Motivator

I suppose this is possible, you would know better than I. In any case I did explicitly call for the host name in the inputs.conf and there should not be any automated feature that over rides my explicit input.

How would I fix the automated override of syslog data?

Should I set the sourcetype to SYSLOG rather than automatic?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.