host_segment being overridden

[tlmayes]

I am using the following in a configuration being distributed to several remote syslog servers.  Works as expected on all UF's, except 1.  From a single UF's, the 'host' field in the indexed events is being reported as "PaloAlto" instead of the 4th segment as expected? 

I searched through all of the .conf files on the UF manually and used BTOOL looking for a missed "host_segment" entry or something hidden in another config that would cause this, none found. 

Am I am missing something obvious to the rest of you?

[monitor:///app01/logs/ASA]
whitelist = .+\.log$
host_segment = 4
index = syn_netfw
sourcetype = cisco:asa
ignoreOlderThan = 2d
disabled = 0

[monitor:///app01/logs/PaloAlto]
whitelist = .+\.log$
host_segment = 4
index = syn_netfw
sourcetype = pan:log
ignoreOlderThan = 2d
disabled = 0

[tlmayes]

My mystery continues.  On the UF causing the problem.  Restatement:  Collecting PaloAlto logs from multiple UF's, all via distributed inputs.conf below.  (1) UF however is reporting the host as PaloAlto.  Searched through all ./apps/* for possible conf that was overwriting of host_segment and none found. 

Final test, changed target directory AND inputs.conf below from */logs/PaloAlto to */logs/PA using a name that would not have been used in any transforms, etc.  Rules out any offending and hidden renaming of host.

Outcome, the events now show host=PA, even though 'host_segment = 4'

[monitor:///app01/logs/ASA]
whitelist = .+\.log$
host_segment = 4
index = syn_netfw
sourcetype = cisco:asa
ignoreOlderThan = 2d
disabled = 0

[monitor:///app01/logs/PaloAlto]
whitelist = .+\.log$
host_segment = 4
index = syn_netfw
sourcetype = pan:log
ignoreOlderThan = 2d
disabled = 0

[tlmayes]

Thanks.  All data passes directly from the UF to the Indexers.  Same process on 4 UF's, but one acting weird 🙄

[tlmayes]

Sourcetype assignment is distributed as an app from the DS to all UF's, so is 100% identical on all UF's.  

[PickleRick]

Are you sure that Palo sends the logs in the format you're expecting? Some solutions name their log sending "syslog" but send something that doesn't conform to any standards.

[tlmayes]

Thanks.  Will have to start eliminating Apps until this problem resolves

[somesoni2]

Is the sourcetype assignment correct on the 1 UF?

The host value can be overridden during Event parsing on HF/Indexer, so you may want to check if some TRANSFORM is applied to that sourcetype.