Keeping Host data when using Heavy Forwarder

[tegnatomm]

We have recently moved from having an internal hosted Splunk setup to Splunk Cloud. Before the move to the Cloud all of our logs sent to syslog-ng kept the correct host information. Now though we have lost this and only see the syslog server as the host. All of the syslog-ng settings are the same, but the change is that we have added a Heavy Forwarder to act as a central spot to send all logs through.

We really would like to keep the original host information if we could. Is this possible with this setup and if so, what config needs to change on the Heavy Forwarder?

Thanks

[hunters_splunk · Accepted solution]

Hi tegnatomm,

If your logs are stored on a different server than its origin, you can override the default host value using these methods:
- Explicitly set the host
CLI command:

splunk edit default-hostname <new_hostname>

• Set the host based on a directory name.
  inputs.conf:

  [monitor://C:\var\logs]
  host_segment=3

Setting host_segment to 3 uses the 3rd segment of the directory path as the host name for files in that directory.
- Set the host based on a regular expression.
inputs.conf

[monitor://C:\var\logs\]
host_regex=(vmail.+)\.log$

Setting host_regex to (vmail.+).log$ selects the second part of the log file name as its host name (e.g., iis_vmail1.log, iis_vmail2.log, ...).

Hope this helps. Thanks!
Hunter