Getting Data In

Host overriding on syslogs

gcusello
Legend

Hi at all,

I have a strange problem:

I have syslogs from an appliance Imola Tiesse (never known before now!).

in these syslogs there isn't the hostname and Splunk assigns as hostname the ip address but i need it, so I trid to insert 

 

host = tiesse_hostname

 

in each inputs.conf's stanza, but host remains the ip address.

I tried overriding with props.conf 

 

[host::my_host]	
TRANSFORMS-my_host = my_host

 

and transforms.conf

 

[My_host]
DEST_KEY = MetaData:Host
REGEX = .
FORMAT = host::tiesse_hostname

 

 but the results is always the same.

Can anyone give me an idea how to solve my problem?

Ciao and thanks.

Giuseppe

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi at all,

the solution was easier that I thought: I forgot to configure

connection_host = none

in the stanzas, for this reason the inputs.conf didin't take the custom values for the host.

Thank you at all.

Ciao.

Giuseppe

View solution in original post

0 Karma

vikramyadav
Contributor

Generally, for the event texts, the value of host is controlled by the host=hostname value in the top of etc/system/local/inputs.conf. This value sets the default for this configuration across all of your input stanzas.

For some sourcetypes (mostly syslog) we try to grab the hostname out of the text of the events.

For your desire to rewrite the host field for existing events, you could alias the old value to the desired value so that searches would return all the data.

 

-----------------------------------------------------------

If this help your like would be appreciated 🙂

gcusello
Legend

Hi at all,

the solution was easier that I thought: I forgot to configure

connection_host = none

in the stanzas, for this reason the inputs.conf didin't take the custom values for the host.

Thank you at all.

Ciao.

Giuseppe

View solution in original post

0 Karma

nwuest
Path Finder

Hi @gcusello,

One thing that you can try that has helped me is on the "syslog" collector that these switches are sending their logs to, is to add the switch and the switches ip to the local host file.

For a Linux box that will be /etc/hosts
For a Windows box that will be in C:\Windows\System32\drivers\etc\hosts


Example for both:
192.168.1.1 tiesse.buttercupgames.local tiesse

After this, the syslog collector should start writing the names in the logs that it is receiving from the tiesse network device. From there, the Splunk Forwarder should monitor those logs and send them in with the correct hostname

Can't wait to hear if this helps you!

V/R,
nwuest

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!