Getting Data In

why isn't my static host configuraton in inputs.conf being honored?

jeff
Contributor

I have the following in inputs.conf:

[udp://32004]
host                   = custom_host
connection_host        = none
sourcetype             = custom_sourcetype
index                  = custom_index
no_appending_timestamp = true

Here is the btool output:

system     [udp://32004]
system     _rcvbuf = 1572864
system     connection_host = none
system     host = custom_host
system     index = custom_index
system     no_appending_timestamp = true
system     sourcetype = custom_sourcetype

Yet, my "host" setting is being set to the IP address of the sending host. Also should point out that the "connection_host" setting was added after discovering this issue (since the documentation for inputs.conf indicates that the default is to assign IP of the connecting host) but it had no effect. However, setting connection_host to "dns" does "correctly" resolve to the fqdn of the connecting host.

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

Is your sourcetype 100% custom, or is it based on the default syslog or syslog-like sourcetypes? Also, is no_appending_timestamp working for you? With it set to true your data should arrive with no timestamp or hostname in Splunk (unless another upstream syslog has added one), so in that case connection_host should be irrelevant.

Otherwise, the syslog sourcetypes will extract the hostname from the syslog timestamp/hostname at the beginning of the line and set host to that, overriding whatever else is specified. If you are appending the timestamp (and host) then that could be happening. Then again, it seems that your config should be allowing that to happen.

gkanapathy
Splunk Employee
Splunk Employee

Okay, then basically, you probably need to kill the default TRANSFORM that comes with the default syslog sourcetype, i.e., TRANSFORMS = and/or TRANSFORMS-host =, i.e., set them to blank so they don't override the input-specified hostname.

0 Karma

jeff
Contributor

sourcetype: variation of the syslog with specific field extraction. I started with sourcetype=syslog though.

no_appending_timestamp: yep, works fine. The source systems are already adding the timestamp, I wanted to add host manually. Right now, I was trying to do this with host = hostname but it's not taking. Setting connection_host = dns is the only way I've gotten this to kinda work (ie, use the hostname rather than the IP address).

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...