I noticed that the host in syslog events is not the forwarder hostname, but is extracted from the events.
How to avoid that ?
example or inputs.conf, I try to force the host
[monitor://var/log/app/]
sourcetype=syslog
host=gloubiboulga
but the events have a different host in it
Jan 13 06:36:45 biffur rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="2857" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.
Jan 14 06:33:23 bonfur rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="2857" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.
The syslog sourcetype is different from all the others. The host is extracted from the events. and the expected format it like :
FYI you can look at the default rules for syslog in $SPLUNK_HOME/etc/system/default/props.conf and transforms.conf (but do not edit the defaults)
You have to use another source type or disable this special syslog feature.
I recommend to define another sourcetype (like syslog_nohost), and still can use a sourcetype renaming at search-time.
example on the indexer in $SPLUNK_HOME/etc/system/local/props.conf (or any any app)
# props.conf
# new sourcetype : syslog without host extraction
# please note the empty TRANSFORMS line
[syslog_nohost]
TRANSFORMS =
pulldown_type = true
maxDist = 3
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False
The syslog sourcetype is different from all the others. The host is extracted from the events. and the expected format it like :
FYI you can look at the default rules for syslog in $SPLUNK_HOME/etc/system/default/props.conf and transforms.conf (but do not edit the defaults)
You have to use another source type or disable this special syslog feature.
I recommend to define another sourcetype (like syslog_nohost), and still can use a sourcetype renaming at search-time.
example on the indexer in $SPLUNK_HOME/etc/system/local/props.conf (or any any app)
# props.conf
# new sourcetype : syslog without host extraction
# please note the empty TRANSFORMS line
[syslog_nohost]
TRANSFORMS =
pulldown_type = true
maxDist = 3
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False
I will try that, I have syslog logs for other servers, so I prefer not to change the default.