Getting Data In

Keeping Host data when using Heavy Forwarder

tegnatomm
Engager

We have recently moved from having an internal hosted Splunk setup to Splunk Cloud. Before the move to the Cloud all of our logs sent to syslog-ng kept the correct host information. Now though we have lost this and only see the syslog server as the host. All of the syslog-ng settings are the same, but the change is that we have added a Heavy Forwarder to act as a central spot to send all logs through.

We really would like to keep the original host information if we could. Is this possible with this setup and if so, what config needs to change on the Heavy Forwarder?

Thanks

0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi tegnatomm,

If your logs are stored on a different server than its origin, you can override the default host value using these methods:
- Explicitly set the host
CLI command:

splunk edit default-hostname <new_hostname>
  • Set the host based on a directory name.
    inputs.conf:

    [monitor://C:\var\logs]
    host_segment=3

Setting host_segment to 3 uses the 3rd segment of the directory path as the host name for files in that directory.
- Set the host based on a regular expression.
inputs.conf

[monitor://C:\var\logs\]
host_regex=(vmail.+)\.log$

Setting host_regex to (vmail.+).log$ selects the second part of the log file name as its host name (e.g., iis_vmail1.log, iis_vmail2.log, ...).

Hope this helps. Thanks!
Hunter

View solution in original post

hunters_splunk
Splunk Employee
Splunk Employee

Hi tegnatomm,

If your logs are stored on a different server than its origin, you can override the default host value using these methods:
- Explicitly set the host
CLI command:

splunk edit default-hostname <new_hostname>
  • Set the host based on a directory name.
    inputs.conf:

    [monitor://C:\var\logs]
    host_segment=3

Setting host_segment to 3 uses the 3rd segment of the directory path as the host name for files in that directory.
- Set the host based on a regular expression.
inputs.conf

[monitor://C:\var\logs\]
host_regex=(vmail.+)\.log$

Setting host_regex to (vmail.+).log$ selects the second part of the log file name as its host name (e.g., iis_vmail1.log, iis_vmail2.log, ...).

Hope this helps. Thanks!
Hunter

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...