Getting Data In

How to enable the forwarder to add another field (such as an alias of a host) during index time?

New Member

Adding an index-time value on a forwarder to capture the hostnames as the host (custom name) is already added in inputs.conf/server.conf

How do we enable Splunk Forwarder to add another field such as the aliases of the host (in this case hostname) during the index-time so that we capture both the custom host and the actual hostname of the server in Splunk?

0 Karma

Splunk Employee
Splunk Employee

@bhavesh91 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

Esteemed Legend

First of all, you can only create an index-time field values from consecutive characters that already inside of the raw event. In the case of adding hostname for cases where the event only has the IP address, you are going to have to add the hostname value to the raw event. The most common and easiest way to do this is to send your events through a syslog service running a local Splunk Forwarder and to configure that service to do a reverse DNS lookup and add this to the events. There is plenty of documentation online describing how to do this, depending on which syslog server you use.

0 Karma

Splunk Employee
Splunk Employee

What you want to look at is adding indexed fields at index time. Here is a document that outlines this :

Your aliases need to be in the data stream though. You can't do anytype of pre-indexing lookups or enrichment in the Splunk ingestion pipeline. So where are you getting the aliases is the big question here...

You also need to consider that adding fields at index time isn't always recommended as it can add more load to indexers. Use cases vary on this, so be aware of potential load this can add if you are doing this on thousands of hosts on already taxed indexers.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...