Getting Data In
Highlighted

Is it possible to configure an app in Splunk to overwrite the hostname in logs sent from a universal forwarder?

New Member

Hi all,

New to Splunk here. I have configured 100 servers to send syslog data. I did this by using puppet to install the universal forwarder, and set a deployment server address to my Splunk server, then in Splunk, I built an app to send syslog data back (using inputs.conf and outputs.conf). The app gets deployed.

I now have syslog data in my Splunk install!

However, given some history on some of these servers, I am getting multiple hostnames per server. (mostly abc and abc.domain.com)

Can I configure Splunk to overwrite the hostname from the logs?

In inputs.conf I tried to add

host=

However that did not seem to work.

0 Karma
Highlighted

Re: Is it possible to configure an app in Splunk to overwrite the hostname in logs sent from a universal forwarder?

Communicator

Hi There,

Check this out, here's the answer to your question: https://answers.splunk.com/answers/45899/how-can-i-use-the-fully-qualified-domain-name-fqdn-as-the-h...

Enjoy!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.