why isn't my static host configuraton in inputs.conf being honored?

[jeff]

I have the following in inputs.conf:

[udp://32004]
host                   = custom_host
connection_host        = none
sourcetype             = custom_sourcetype
index                  = custom_index
no_appending_timestamp = true

Here is the btool output:

system     [udp://32004]
system     _rcvbuf = 1572864
system     connection_host = none
system     host = custom_host
system     index = custom_index
system     no_appending_timestamp = true
system     sourcetype = custom_sourcetype

Yet, my "host" setting is being set to the IP address of the sending host. Also should point out that the "connection_host" setting was added after discovering this issue (since the documentation for inputs.conf indicates that the default is to assign IP of the connecting host) but it had no effect. However, setting connection_host to "dns" does "correctly" resolve to the fqdn of the connecting host.

[gkanapathy]

Is your sourcetype 100% custom, or is it based on the default syslog or syslog-like sourcetypes? Also, is no_appending_timestamp working for you? With it set to true your data should arrive with no timestamp or hostname in Splunk (unless another upstream syslog has added one), so in that case connection_host should be irrelevant.

Otherwise, the syslog sourcetypes will extract the hostname from the syslog timestamp/hostname at the beginning of the line and set host to that, overriding whatever else is specified. If you are appending the timestamp (and host) then that could be happening. Then again, it seems that your config should be allowing that to happen.

[jeff]

sourcetype: variation of the syslog with specific field extraction. I started with sourcetype=syslog though.

noappendingtimestamp: yep, works fine. The source systems are already adding the timestamp, I wanted to add host manually. Right now, I was trying to do this with host = hostname but it's not taking. Setting connection_host = dns is the only way I've gotten this to kinda work (ie, use the hostname rather than the IP address).

[gkanapathy]

Okay, then basically, you probably need to kill the default TRANSFORM that comes with the default syslog sourcetype, i.e., TRANSFORMS = and/or TRANSFORMS-host =, i.e., set them to blank so they don't override the input-specified hostname.