Getting Data In

How do I set a hostname?

matt
Splunk Employee
Splunk Employee

What do I need to do to set the correct hostname for an event?

1 Solution

matt
Splunk Employee
Splunk Employee

Hostnames in splunk can be set in many ways.

You can set it explicitly in inputs.conf.

For incoming TCP traffic, the host can be set with the following in your inputs.conf connection_host = ip | dns

The host value can always be overwritten via props/transforms configurations. This is how the host value is set when the event is sourcetyped as syslog. Props/transforms configs will trump what is defined in inputs.conf

More details can be found here

View solution in original post

jrodman
Splunk Employee
Splunk Employee

Corrolary to emma: be wary of sourcetyping things as 'syslog' which aren't, as you may get other strings pulled out as a hostname.

emma
Splunk Employee
Splunk Employee

an important thing to note: if you're indexing syslog data, set the sourcetype to "syslog" and your host will be extracted automatically from your events. you can set a default host that will get assigned to any event that doesn't contain a host name or IP address.

matt
Splunk Employee
Splunk Employee

Hostnames in splunk can be set in many ways.

You can set it explicitly in inputs.conf.

For incoming TCP traffic, the host can be set with the following in your inputs.conf connection_host = ip | dns

The host value can always be overwritten via props/transforms configurations. This is how the host value is set when the event is sourcetyped as syslog. Props/transforms configs will trump what is defined in inputs.conf

More details can be found here

Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...