Getting Data In

How to disable the host extraction for syslog sourcetype

Communicator

I noticed that the host in syslog events is not the forwarder hostname, but is extracted from the events.
How to avoid that ?

example or inputs.conf, I try to force the host


[monitor://var/log/app/]
sourcetype=syslog
host=gloubiboulga

but the events have a different host in it


Jan 13 06:36:45 biffur rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="2857" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.
Jan 14 06:33:23 bonfur rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="2857" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.

1 Solution

Splunk Employee
Splunk Employee

The syslog sourcetype is different from all the others. The host is extracted from the events. and the expected format it like :
FYI you can look at the default rules for syslog in $SPLUNK_HOME/etc/system/default/props.conf and transforms.conf (but do not edit the defaults)

You have to use another source type or disable this special syslog feature.

I recommend to define another sourcetype (like syslog_nohost), and still can use a sourcetype renaming at search-time.

example on the indexer in $SPLUNK_HOME/etc/system/local/props.conf (or any any app)


# props.conf
# new sourcetype : syslog without host extraction
# please note the empty TRANSFORMS line

[syslog_nohost]
TRANSFORMS =
pulldown_type = true
maxDist = 3
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False

View solution in original post

Splunk Employee
Splunk Employee

The syslog sourcetype is different from all the others. The host is extracted from the events. and the expected format it like :
FYI you can look at the default rules for syslog in $SPLUNK_HOME/etc/system/default/props.conf and transforms.conf (but do not edit the defaults)

You have to use another source type or disable this special syslog feature.

I recommend to define another sourcetype (like syslog_nohost), and still can use a sourcetype renaming at search-time.

example on the indexer in $SPLUNK_HOME/etc/system/local/props.conf (or any any app)


# props.conf
# new sourcetype : syslog without host extraction
# please note the empty TRANSFORMS line

[syslog_nohost]
TRANSFORMS =
pulldown_type = true
maxDist = 3
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False

View solution in original post

Communicator

I will try that, I have syslog logs for other servers, so I prefer not to change the default.

0 Karma