Removed the syslog-host transform - but hostname is still getting pulled from /var/log/messages

[di2esysadmin]

Sourcetype=syslog results are picking up the short hostname from the /var/log/messages file. I tried to correct this per the instructions here : http://answers.splunk.com/answers/6895/can-i-prevent-the-default-index-time-extraction-for-the-host-...

Specifically, I now have a local/props.conf file. The contents are as follows:

[syslog]
TRANSFORMS =

The output looks correct, TRANSFORMS is null. Yet the hostname is still getting set to the shortname, presumably from the shortname in the /var/log/messages file.

splunk cmd btool props list syslog --debug
Splunk_TA_ [syslog]
system ANNOTATE_PUNCT = True
system BREAK_ONLY_BEFORE =
system BREAK_ONLY_BEFORE_DATE = True
.
.
system TIME_FORMAT = %b %d %H:%M:%S
system TRANSFORMS =
system TRUNCATE = 10000
.
.


Any ideas?

Thanks,
Karla

[jreuter_splunk · Accepted solution]

More information would be required to understand why this is not taking effect. First guess: did you make this change to props.conf on the forwarder? It needs to be configured on the indexer as the forwarder only handles the input stage. The following props.conf subset is applied on a universal/lightweight forwarder:

sourcetype CHARSET NO_BINARY_CHECK CHECK_METHOD CHECK_FOR_HEADER PREFIX_SOURCETYPE

Reference:
Where do I configure my Splunk settings?

Verify the above, along with the final sourcetype. Look for other transforms that are related to the source or other attributes. Reply to your open support case if none of this helps to resolve the issue.

[di2esysadmin]

I did NOT make it on the indexer. Got it in one ! thanks.

[di2esysadmin]

As I suspected. Thanks Martin.

Any suggestions on how to solve the problem I posed? 🙂

[martin_mueller]

To change already-indexed data you would need to remove it and re-index.

[di2esysadmin]

An additional related question . . . once I get this working the way I want, is it possible to change the hostname settings for data already indexed? Or this that just a ridiculous question?