Getting Data In

Host overriding on syslogs

gcusello
Esteemed Legend

Hi at all,

I have a strange problem:

I have syslogs from an appliance Imola Tiesse (never known before now!).

in these syslogs there isn't the hostname and Splunk assigns as hostname the ip address but i need it, so I trid to insert 

 

host = tiesse_hostname

 

in each inputs.conf's stanza, but host remains the ip address.

I tried overriding with props.conf 

 

[host::my_host]	
TRANSFORMS-my_host = my_host

 

and transforms.conf

 

[My_host]
DEST_KEY = MetaData:Host
REGEX = .
FORMAT = host::tiesse_hostname

 

 but the results is always the same.

Can anyone give me an idea how to solve my problem?

Ciao and thanks.

Giuseppe

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi at all,

the solution was easier that I thought: I forgot to configure

connection_host = none

in the stanzas, for this reason the inputs.conf didin't take the custom values for the host.

Thank you at all.

Ciao.

Giuseppe

View solution in original post

0 Karma

vikramyadav
Contributor

Generally, for the event texts, the value of host is controlled by the host=hostname value in the top of etc/system/local/inputs.conf. This value sets the default for this configuration across all of your input stanzas.

For some sourcetypes (mostly syslog) we try to grab the hostname out of the text of the events.

For your desire to rewrite the host field for existing events, you could alias the old value to the desired value so that searches would return all the data.

 

-----------------------------------------------------------

If this help your like would be appreciated 🙂

gcusello
Esteemed Legend

Hi at all,

the solution was easier that I thought: I forgot to configure

connection_host = none

in the stanzas, for this reason the inputs.conf didin't take the custom values for the host.

Thank you at all.

Ciao.

Giuseppe

0 Karma

nwuest
Path Finder

Hi @gcusello,

One thing that you can try that has helped me is on the "syslog" collector that these switches are sending their logs to, is to add the switch and the switches ip to the local host file.

For a Linux box that will be /etc/hosts
For a Windows box that will be in C:\Windows\System32\drivers\etc\hosts


Example for both:
192.168.1.1 tiesse.buttercupgames.local tiesse

After this, the syslog collector should start writing the names in the logs that it is receiving from the tiesse network device. From there, the Splunk Forwarder should monitor those logs and send them in with the correct hostname

Can't wait to hear if this helps you!

V/R,
nwuest

Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...