Getting Data In

How to override host metadata?

jmonreal
New Member

Good day everyone!

I have my Splunk cluster separated in Forwarders (inside each application server), Indexer (a set of servers running only Splunk as indexer) and Search Heads (a set of servers running only Splunk as search head).

I have on each application server a rsyslog that is sending logs to a certain $PORT which is also configured in the Splunk Forwarder as follows:

Inside the directory $SPLUNK_HOME/etc/apps/search/default/

inputs.conf

[udp://44444]
disabled        = false
_TCP_ROUTING    = test
index   = main
source  = docker
sourcetype      = docker
_meta   = host::"registrydocker.localdomain.com" site::"sao" environment::"_default" pool::"registrydocker" domain::"localdomain.com" cloud::"true"

outputs.conf

[tcpout:test]
server = 192.168.1.101:9997,192.168.1.100:9997
disabled = false

Now the indexer has no special configuration.

When I look at the logs in Splunk, the host shows 127.0.0.1 instead of registrydocker.localdomain.com
How should I be overriding the host and other metadata? Is it possible to override host and sourcetype for the same log lines?

0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

Hi jmonreal,

There are a few things here:
Please do not make your configuration changes in /default. There is a good chance that if you upgrade, your configurations will be overwritten.

Have you looked at using the "host" directive rather than using _meta?

[udp://44444]
disabled        = false
index   = main
source  = docker
sourcetype   = docker
host = registrydocker.localdomain.com
_TCP_ROUTING    = test
_meta   =  site::"sao" environment::"_default" pool::"registrydocker" domain::"localdomain.com" cloud::"true"

You can also add the "host" directive to your inputs.conf:

[tcpout:test]
 server = 192.168.1.101:9997,192.168.1.100:9997
 disabled = false
 host = registrydocker.localdomain.com

If you are not seeing any of your _meta fields, you may also need to check your fields.conf.

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

Hi jmonreal,

There are a few things here:
Please do not make your configuration changes in /default. There is a good chance that if you upgrade, your configurations will be overwritten.

Have you looked at using the "host" directive rather than using _meta?

[udp://44444]
disabled        = false
index   = main
source  = docker
sourcetype   = docker
host = registrydocker.localdomain.com
_TCP_ROUTING    = test
_meta   =  site::"sao" environment::"_default" pool::"registrydocker" domain::"localdomain.com" cloud::"true"

You can also add the "host" directive to your inputs.conf:

[tcpout:test]
 server = 192.168.1.101:9997,192.168.1.100:9997
 disabled = false
 host = registrydocker.localdomain.com

If you are not seeing any of your _meta fields, you may also need to check your fields.conf.

dshpritz
SplunkTrust
SplunkTrust

Worked over IRC, turns out the issue was that the inputs.conf needed:

connection_host = none

On the [udp://] stanza.

0 Karma

jmonreal
New Member

This one worked! Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...