Getting Data In

How to change the value of host field when receiving some devices log from one host?

Explorer

if I received 20 devices log from a single syslog server , how can I seperate host field to those 20 source of logs instead of my syslog server IP address?

0 Karma

SplunkTrust
SplunkTrust

This is best done in your syslog server, rather than in Splunk. Have syslog save data in separate files based on the originating system. If you include the source address in the file path, a Splunk forwarder can use that as the host name. See https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html for more.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

To do it within Splunk, I think what you want to look at is this: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Overridedefaulthostassignments

0 Karma