preserve host name when using a kiwi server to collect logs

[JWBailey]

We have non-windows devices sending their syslog information to a Kiwi server that is hosted on a windows box.
The kiwi server is configured to filter events and write them to individual log files.

We have a universal forwarder installed on the Kiwi server with various apps deployed to the server.
Each app is configured with a local inputs.conf file to monitor a specific log file.

How do I preserve the host information from the original devices and prevent splunk from grabbing the host value from $SPLUNK_HOME\etc\system\local\inputs.conf ?

Currently some of my sourcetypes successfully do this, and the host field contains the IP address of the original device, some of my sourcetypes do not and it is incorrectly showing the Kiwi server name in the host field.

Thank you.

[srioux]

Had this issue in a previous environment as well. I remember Kiwi not playing nice with a few other systems. As far as I can recall, there were a few ways around it:

• Don't use Kiwi as a syslog aggregation box (if you have the option of spinning up a *nix box). Whatever flavor you end up using will likely have flexible syslog output configurations (i.e. templates in rsyslog).
• Make sure you use the appropriate Kiwi settings - there's a few that you may have to play with in order to get it working the way you expect, including "Retain the original source address of the message" and "Spoof Network Packet". Can find more documentation on Kiwi's site.
• http://www.kiwisyslog.com/help/syslog/index.html?action_forward_to_another_host.htm

I can't speak to the validity of the second solution, since we just ended up putting dedicated RHEL-flavored forwarders in place to capture & send along the messages, and were gradually migrating away from Kiwi.