Hi at all,
I have a strange problem:
I have syslogs from an appliance Imola Tiesse (never known before now!).
in these syslogs there isn't the hostname and Splunk assigns as hostname the ip address but i need it, so I trid to insert
host = tiesse_hostname
in each inputs.conf's stanza, but host remains the ip address.
I tried overriding with props.conf
[host::my_host]
TRANSFORMS-my_host = my_host
and transforms.conf
[My_host]
DEST_KEY = MetaData:Host
REGEX = .
FORMAT = host::tiesse_hostname
but the results is always the same.
Can anyone give me an idea how to solve my problem?
Ciao and thanks.
Giuseppe
Hi at all,
the solution was easier that I thought: I forgot to configure
connection_host = none
in the stanzas, for this reason the inputs.conf didin't take the custom values for the host.
Thank you at all.
Ciao.
Giuseppe
Generally, for the event texts, the value of host is controlled by the host=hostname value in the top of etc/system/local/inputs.conf. This value sets the default for this configuration across all of your input stanzas.
For some sourcetypes (mostly syslog) we try to grab the hostname out of the text of the events.
For your desire to rewrite the host field for existing events, you could alias the old value to the desired value so that searches would return all the data.
-----------------------------------------------------------
If this help your like would be appreciated 🙂
Hi at all,
the solution was easier that I thought: I forgot to configure
connection_host = none
in the stanzas, for this reason the inputs.conf didin't take the custom values for the host.
Thank you at all.
Ciao.
Giuseppe
Hi @gcusello,
One thing that you can try that has helped me is on the "syslog" collector that these switches are sending their logs to, is to add the switch and the switches ip to the local host file.
For a Linux box that will be /etc/hosts
For a Windows box that will be in C:\Windows\System32\drivers\etc\hosts
Example for both:
192.168.1.1 tiesse.buttercupgames.local tiesse
After this, the syslog collector should start writing the names in the logs that it is receiving from the tiesse network device. From there, the Splunk Forwarder should monitor those logs and send them in with the correct hostname
Can't wait to hear if this helps you!
V/R,
nwuest