How to disable the host extraction for syslog sourcetype

[mataharry]

I noticed that the host in syslog events is not the forwarder hostname, but is extracted from the events.
How to avoid that ?

example or inputs.conf, I try to force the host

[monitor://var/log/app/]

sourcetype=syslog

host=gloubiboulga

but the events have a different host in it

Jan 13 06:36:45 biffur rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="2857" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.

Jan 14 06:33:23 bonfur rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="2857" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.

[yannK · Accepted solution]

The syslog sourcetype is different from all the others. The host is extracted from the events. and the expected format it like :
FYI you can look at the default rules for syslog in $SPLUNK_HOME/etc/system/default/props.conf and transforms.conf (but do not edit the defaults)

You have to use another source type or disable this special syslog feature.

I recommend to define another sourcetype (like syslog_nohost), and still can use a sourcetype renaming at search-time.

example on the indexer in $SPLUNK_HOME/etc/system/local/props.conf (or any any app)

 # props.conf 

 # new sourcetype : syslog without host extraction 

 # please note the empty TRANSFORMS line 

[syslog_nohost]
TRANSFORMS =
pulldown_type = true
maxDist = 3
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False

[mataharry]

I will try that, I have syslog logs for other servers, so I prefer not to change the default.