Getting Data In

Is it possible to use an indexer's IP address for output on universal forwarder, but display the host name on the indexer?

splunkmasterfle
Path Finder

Hi,

Is there a way to use the IP address of the indexer on the universal forwarder but have the name of the host displayed on the indexer ??

Here is my configuration :

[tcpout]
defaultGroup = indexer-group

[tcpout:indexer-group]
maxQueueSize = auto
server = 172.44.23.114:9997

[tcpout-server://172.44.23.114:9997]

Meaning that on my index it would show "prod-log-server" (the hostname) instead of 172.44.23.114

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The indexer address used in outputs.conf is unrelated to any hosts set in inputs.conf (or overridden in transforms.conf... so yes, there is a way - nothing's in your way in fact.

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...