Getting Data In

How to disable hostname chaining?

zliu
Splunk Employee
Splunk Employee

How to disable hostname chaining? Splunk picks the chained hostname rather than the original.

Tags (2)
0 Karma
1 Solution

zliu
Splunk Employee
Splunk Employee

There are two alternative solutions for this issue: >

  1. Modify the configuration of syslog server to disable hostname chaining. This is the preferred method since it removes one of the moving parts in this equation and ensures that events being sourceypted as syslog that do not have a chained hostname are not impacted Below is a link for syslog-ng.conf reference: http://linux.die.net/man/5/syslog-ng.conf Look for "chain_hostnames"

  2. Create a props.conf file under your $SPLUNK_HOME/etc/apps/SplunkEnterrpiseSecuritySuite/local with below content:

[syslog] TRANSFORMS = syslog-header-stripper-ts-host, syslog-host

This will tell Splunk to remove the the chained hostname and timestamp from the event and then extract the hostname from the newly modified event.

View solution in original post

zliu
Splunk Employee
Splunk Employee

There are two alternative solutions for this issue: >

  1. Modify the configuration of syslog server to disable hostname chaining. This is the preferred method since it removes one of the moving parts in this equation and ensures that events being sourceypted as syslog that do not have a chained hostname are not impacted Below is a link for syslog-ng.conf reference: http://linux.die.net/man/5/syslog-ng.conf Look for "chain_hostnames"

  2. Create a props.conf file under your $SPLUNK_HOME/etc/apps/SplunkEnterrpiseSecuritySuite/local with below content:

[syslog] TRANSFORMS = syslog-header-stripper-ts-host, syslog-host

This will tell Splunk to remove the the chained hostname and timestamp from the event and then extract the hostname from the newly modified event.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...