Getting Data In

How do I set a hostname?

Splunk Employee
Splunk Employee

What do I need to do to set the correct hostname for an event?

1 Solution

Splunk Employee
Splunk Employee

Hostnames in splunk can be set in many ways.

You can set it explicitly in inputs.conf.

For incoming TCP traffic, the host can be set with the following in your inputs.conf connection_host = ip | dns

The host value can always be overwritten via props/transforms configurations. This is how the host value is set when the event is sourcetyped as syslog. Props/transforms configs will trump what is defined in inputs.conf

More details can be found here

View solution in original post

Splunk Employee
Splunk Employee

Corrolary to emma: be wary of sourcetyping things as 'syslog' which aren't, as you may get other strings pulled out as a hostname.

Splunk Employee
Splunk Employee

an important thing to note: if you're indexing syslog data, set the sourcetype to "syslog" and your host will be extracted automatically from your events. you can set a default host that will get assigned to any event that doesn't contain a host name or IP address.

Splunk Employee
Splunk Employee

Hostnames in splunk can be set in many ways.

You can set it explicitly in inputs.conf.

For incoming TCP traffic, the host can be set with the following in your inputs.conf connection_host = ip | dns

The host value can always be overwritten via props/transforms configurations. This is how the host value is set when the event is sourcetyped as syslog. Props/transforms configs will trump what is defined in inputs.conf

More details can be found here

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!