Getting Data In

Host overriding on syslogs

gcusello
SplunkTrust
SplunkTrust

Hi at all,

I have a strange problem:

I have syslogs from an appliance Imola Tiesse (never known before now!).

in these syslogs there isn't the hostname and Splunk assigns as hostname the ip address but i need it, so I trid to insert 

 

host = tiesse_hostname

 

in each inputs.conf's stanza, but host remains the ip address.

I tried overriding with props.conf 

 

[host::my_host]	
TRANSFORMS-my_host = my_host

 

and transforms.conf

 

[My_host]
DEST_KEY = MetaData:Host
REGEX = .
FORMAT = host::tiesse_hostname

 

 but the results is always the same.

Can anyone give me an idea how to solve my problem?

Ciao and thanks.

Giuseppe

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi at all,

the solution was easier that I thought: I forgot to configure

connection_host = none

in the stanzas, for this reason the inputs.conf didin't take the custom values for the host.

Thank you at all.

Ciao.

Giuseppe

View solution in original post

0 Karma

vikramyadav
Contributor

Generally, for the event texts, the value of host is controlled by the host=hostname value in the top of etc/system/local/inputs.conf. This value sets the default for this configuration across all of your input stanzas.

For some sourcetypes (mostly syslog) we try to grab the hostname out of the text of the events.

For your desire to rewrite the host field for existing events, you could alias the old value to the desired value so that searches would return all the data.

 

-----------------------------------------------------------

If this help your like would be appreciated 🙂

gcusello
SplunkTrust
SplunkTrust

Hi at all,

the solution was easier that I thought: I forgot to configure

connection_host = none

in the stanzas, for this reason the inputs.conf didin't take the custom values for the host.

Thank you at all.

Ciao.

Giuseppe

0 Karma

nwuest
Path Finder

Hi @gcusello,

One thing that you can try that has helped me is on the "syslog" collector that these switches are sending their logs to, is to add the switch and the switches ip to the local host file.

For a Linux box that will be /etc/hosts
For a Windows box that will be in C:\Windows\System32\drivers\etc\hosts


Example for both:
192.168.1.1 tiesse.buttercupgames.local tiesse

After this, the syslog collector should start writing the names in the logs that it is receiving from the tiesse network device. From there, the Splunk Forwarder should monitor those logs and send them in with the correct hostname

Can't wait to hear if this helps you!

V/R,
nwuest

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...