I have the following in inputs.conf:
[udp://32004] host = custom_host connection_host = none sourcetype = custom_sourcetype index = custom_index no_appending_timestamp = true
Here is the btool output:
system [udp://32004] system _rcvbuf = 1572864 system connection_host = none system host = custom_host system index = custom_index system no_appending_timestamp = true system sourcetype = custom_sourcetype
Yet, my "host" setting is being set to the IP address of the sending host. Also should point out that the "connection_host" setting was added after discovering this issue (since the documentation for inputs.conf indicates that the default is to assign IP of the connecting host) but it had no effect. However, setting connection_host to "dns" does "correctly" resolve to the fqdn of the connecting host.
Is your sourcetype 100% custom, or is it based on the default
syslog or syslog-like sourcetypes? Also, is
no_appending_timestamp working for you? With it set to
true your data should arrive with no timestamp or hostname in Splunk (unless another upstream syslog has added one), so in that case
connection_host should be irrelevant.
syslog sourcetypes will extract the hostname from the syslog timestamp/hostname at the beginning of the line and set host to that, overriding whatever else is specified. If you are appending the timestamp (and host) then that could be happening. Then again, it seems that your config should be allowing that to happen.
sourcetype: variation of the syslog with specific field extraction. I started with sourcetype=syslog though.
noappendingtimestamp: yep, works fine. The source systems are already adding the timestamp, I wanted to add host manually. Right now, I was trying to do this with host = hostname but it's not taking. Setting connection_host = dns is the only way I've gotten this to kinda work (ie, use the hostname rather than the IP address).
Okay, then basically, you probably need to kill the default TRANSFORM that comes with the default
syslog sourcetype, i.e.,
TRANSFORMS = and/or
TRANSFORMS-host =, i.e., set them to blank so they don't override the input-specified hostname.