Modify sourcetype host extraction

[FRoth]

I noticed that I receive logs from a single linux system with two different host names.

Some inputs are files in the /var/log/apache2 directory.

These are delivered as coming from lvps87-230-26-17.dedicated.hosteurope.de

The sourcetype of this input is access_common.

Another input is /var/log/auth.log

These log lines are delivered as coming from lvps87-230-26-17

The sourcetype is syslog

I understand that the sourcetype syslog does not take the FQDN, but I would like to change that and dont know where to find that configuration.

The linux host delivers by the Universal Forwarder to my Splunk index server. It is not a TCP or UDP Input.

Is there anyone with a solution to this issue?

---- 1 hour later ----

I noticed that splunk does not take the host name of the Universal Forwarder hostname as the database field "host" if the sourcetype is syslog.

It actually extracts the hostname from the log line which is quite useful in the case that several hosts are logging into a single syslog-file. (in my case auth.log)

What I did to avoid the duplicate host name entries was:

I changed the syslog-ng options of my system from options use_fqdn(no) to use_fqdn(yes)

Nevertheless - I would like to know how the sourcetype syslog can be configured to take the FQDN of the delivering Universal Forwarder and not to extract the hostname from the log line.
Thanks for your help.

[gkanapathy · Accepted solution]

Add the config to props.conf on the indexer. (See here, noting that Universal and Light Forwarders work the same way.) This will affect all data with sourcetype syslog:

[syslog]
# yes, the next line sets it to an empty value
TRANSFORMS =

This overrides the default in $SPLUNK_HOME/etc/system/default/props.conf, of TRANSFORMS = syslog-host.

There are a few other versions of syslog in the defaults (e.g. cisco_syslog, windows_snare_syslog) that will have their own config that you would have to override separately if you desire.