Getting Data In

Keeping Host data when using Heavy Forwarder

tegnatomm
Engager

We have recently moved from having an internal hosted Splunk setup to Splunk Cloud. Before the move to the Cloud all of our logs sent to syslog-ng kept the correct host information. Now though we have lost this and only see the syslog server as the host. All of the syslog-ng settings are the same, but the change is that we have added a Heavy Forwarder to act as a central spot to send all logs through.

We really would like to keep the original host information if we could. Is this possible with this setup and if so, what config needs to change on the Heavy Forwarder?

Thanks

0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi tegnatomm,

If your logs are stored on a different server than its origin, you can override the default host value using these methods:
- Explicitly set the host
CLI command:

splunk edit default-hostname <new_hostname>
  • Set the host based on a directory name.
    inputs.conf:

    [monitor://C:\var\logs]
    host_segment=3

Setting host_segment to 3 uses the 3rd segment of the directory path as the host name for files in that directory.
- Set the host based on a regular expression.
inputs.conf

[monitor://C:\var\logs\]
host_regex=(vmail.+)\.log$

Setting host_regex to (vmail.+).log$ selects the second part of the log file name as its host name (e.g., iis_vmail1.log, iis_vmail2.log, ...).

Hope this helps. Thanks!
Hunter

View solution in original post

hunters_splunk
Splunk Employee
Splunk Employee

Hi tegnatomm,

If your logs are stored on a different server than its origin, you can override the default host value using these methods:
- Explicitly set the host
CLI command:

splunk edit default-hostname <new_hostname>
  • Set the host based on a directory name.
    inputs.conf:

    [monitor://C:\var\logs]
    host_segment=3

Setting host_segment to 3 uses the 3rd segment of the directory path as the host name for files in that directory.
- Set the host based on a regular expression.
inputs.conf

[monitor://C:\var\logs\]
host_regex=(vmail.+)\.log$

Setting host_regex to (vmail.+).log$ selects the second part of the log file name as its host name (e.g., iis_vmail1.log, iis_vmail2.log, ...).

Hope this helps. Thanks!
Hunter

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...