Host overriding on syslogs

[gcusello]

Hi at all,

I have a strange problem:

I have syslogs from an appliance Imola Tiesse (never known before now!).

in these syslogs there isn't the hostname and Splunk assigns as hostname the ip address but i need it, so I trid to insert 

host = tiesse_hostname

in each inputs.conf's stanza, but host remains the ip address.

I tried overriding with props.conf 

[host::my_host]	
TRANSFORMS-my_host = my_host

and transforms.conf

[My_host]
DEST_KEY = MetaData:Host
REGEX = .
FORMAT = host::tiesse_hostname

 but the results is always the same.

Can anyone give me an idea how to solve my problem?

Ciao and thanks.

Giuseppe

[vikramyadav]

Generally, for the event texts, the value of host is controlled by the host=hostname value in the top of etc/system/local/inputs.conf. This value sets the default for this configuration across all of your input stanzas.

For some sourcetypes (mostly syslog) we try to grab the hostname out of the text of the events.

For your desire to rewrite the host field for existing events, you could alias the old value to the desired value so that searches would return all the data.

-----------------------------------------------------------

If this help your like would be appreciated 🙂

[gcusello · Accepted solution]

Hi at all,

the solution was easier that I thought: I forgot to configure

connection_host = none

in the stanzas, for this reason the inputs.conf didin't take the custom values for the host.

Thank you at all.

Ciao.

Giuseppe

[nwuest]

Hi @gcusello,

One thing that you can try that has helped me is on the "syslog" collector that these switches are sending their logs to, is to add the switch and the switches ip to the local host file.

For a Linux box that will be /etc/hosts
For a Windows box that will be in C:\Windows\System32\drivers\etc\hosts

Example for both:
192.168.1.1 tiesse.buttercupgames.local tiesse

After this, the syslog collector should start writing the names in the logs that it is receiving from the tiesse network device. From there, the Splunk Forwarder should monitor those logs and send them in with the correct hostname

Can't wait to hear if this helps you!

V/R,
nwuest