Getting Data In

How to change the value of host field when receiving some devices log from one host?

sabaKhadivi
Path Finder

if I received 20 devices log from a single syslog server , how can I seperate host field to those 20 source of logs instead of my syslog server IP address?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is best done in your syslog server, rather than in Splunk. Have syslog save data in separate files based on the originating system. If you include the source address in the file path, a Splunk forwarder can use that as the host name. See https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html for more.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

jdsl
New Member

To do it within Splunk, I think what you want to look at is this: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Overridedefaulthostassignments

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!