Setting host to hostname vs IP address

agodoy · ‎04-26-2013

I have different devices sending data via syslog.

Current Stanza Example:

[udp//IP:PORT]
host = hostname
sourcetype = syslog

However, events still show up as host = ip address. Is there another place to do this?

agodoy · ‎06-28-2013

It seems that the process is not as straight forward as I thought for syslog devices.

See this blog post:

http://blogs.splunk.com/2008/04/16/overriding-default-syslog-host-extraction/

Now trying to figure out how to do this in a Cluster.

gnovak · ‎04-26-2013

I had the same problem, even if I told it not to. It sorta double dips your hostnames, especially if you already had the hostname show up prior to enabling syslog.

Setting host to hostname vs IP address

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Setting host to hostname vs IP address

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future