Getting Data In

Keeping Host data when using Heavy Forwarder

tegnatomm
Engager

We have recently moved from having an internal hosted Splunk setup to Splunk Cloud. Before the move to the Cloud all of our logs sent to syslog-ng kept the correct host information. Now though we have lost this and only see the syslog server as the host. All of the syslog-ng settings are the same, but the change is that we have added a Heavy Forwarder to act as a central spot to send all logs through.

We really would like to keep the original host information if we could. Is this possible with this setup and if so, what config needs to change on the Heavy Forwarder?

Thanks

0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi tegnatomm,

If your logs are stored on a different server than its origin, you can override the default host value using these methods:
- Explicitly set the host
CLI command:

splunk edit default-hostname <new_hostname>
  • Set the host based on a directory name.
    inputs.conf:

    [monitor://C:\var\logs]
    host_segment=3

Setting host_segment to 3 uses the 3rd segment of the directory path as the host name for files in that directory.
- Set the host based on a regular expression.
inputs.conf

[monitor://C:\var\logs\]
host_regex=(vmail.+)\.log$

Setting host_regex to (vmail.+).log$ selects the second part of the log file name as its host name (e.g., iis_vmail1.log, iis_vmail2.log, ...).

Hope this helps. Thanks!
Hunter

View solution in original post

hunters_splunk
Splunk Employee
Splunk Employee

Hi tegnatomm,

If your logs are stored on a different server than its origin, you can override the default host value using these methods:
- Explicitly set the host
CLI command:

splunk edit default-hostname <new_hostname>
  • Set the host based on a directory name.
    inputs.conf:

    [monitor://C:\var\logs]
    host_segment=3

Setting host_segment to 3 uses the 3rd segment of the directory path as the host name for files in that directory.
- Set the host based on a regular expression.
inputs.conf

[monitor://C:\var\logs\]
host_regex=(vmail.+)\.log$

Setting host_regex to (vmail.+).log$ selects the second part of the log file name as its host name (e.g., iis_vmail1.log, iis_vmail2.log, ...).

Hope this helps. Thanks!
Hunter

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...