Getting Data In

syslog host transform base on event

bambarit
Explorer

I have syslog server and installed HF,

when send logs from HF to indexer, the host is represent base on Event host,

can we extract new field for HF hostname?

1 Solution

thambisetty
SplunkTrust
SplunkTrust

@bambarit 

yes you can change on forwarder before you send logs to Indexer.

————————————
If this helps, give a like below.

View solution in original post

0 Karma

vikramyadav
Contributor

Hi @bambarit 

Yes you can change the name of host. Also you can extract new fields from HF.

 

-----------------------------------------

If this helps your like will be appreciated 🙂

bambarit
Explorer

can we just use transform from indexer?

0 Karma

thambisetty
SplunkTrust
SplunkTrust

You can modify host value and you can have extra meta fields to hold information of hf if you wish to.

————————————
If this helps, give a like below.
0 Karma

bambarit
Explorer

do you mean host value in forwarder inputs?

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@bambarit 

yes you can change on forwarder before you send logs to Indexer.

————————————
If this helps, give a like below.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...