How to assign the appropriate host name for udp input type for universal forwarder?

[asingla]

I have a universal forwarder listening on udp:12000 for messages from various processes and relaying it to splunk indexer. Universal forwarder are receiving messages from some local processes (running on the same machine) and some from remote processes. For remote process the host name in the messages are correct i.e. the IP for those machines but for local process it's 127.0.0.1. I understand the reason as the local processes are configured with 127.0.0.1/localhost. If I change the configuration (for the local processes) with the IP of the machine, then I see the IP in the messages. Is there anyway I can configure universal forwarder to replace the localhost/127.0.0.1 with the machine IP and still retain the host name for the remote processes as it is?

[MarioM]

or you could filter at the inputs.conf in your UF but you cannot have a generic udp/tcp stanza and filtered ones,you will have to set it (and maintain it) for each device.

inputs.conf:

[udp://127.0.0.1:514]
host= <host ip or name>

[udp://ip1:514]
host= <host ip or name>

...

OR

[tcp://127.0.0.1:514]
host= <host ip or name>

[tcp://ip1:514]
host= <host ip or name>

...

[MarioM]

The problem is that Universal Forwarder doesnot do/have the following:

NO Bundles Python

NO Per-event filtering

NO Event routing

NO Event parsing

Then you will have to override the host metadata with matching regex at Indexer Level:

transforms.conf

[host_override]
DEST_KEY = MetaData:Host 
REGEX = (localhost\/127\.0\.0\.1)
FORMAT = host::<your host ip or name>

props.conf

[source::udp:514]
TRANSFORMS-localhostrename = host_override

[josephnoall]

I have exactly the same problem, does anyone know of a way around this? It appears from the docs that you can only manually override the host for inputs that are monitoring files or directories, but I need some way of setting the host to the local machine name for UDP/TCP inputs. (Localhost/127.0.0.1 are not very useful!)