Getting Data In

wrong HOST value

sunnykkim
Engager

Hi,

I have a forwarder sending a syslog file to the receiver. The syslog has entries like:

Jul 27 09:50:21 ip-10-196-173-139 postfix .....

And I don't want the "ip-10-196-173-139" to show up as the "host" on the receiver when doing searches. So I edited the "inputs.conf" like this:


[default]
host = abc.mydomain.com

[monitor:///var/log/syslog]
disabled = false
host = abc.mydomain.com


I did this in a bunch of places since nothing seemed to work:

/opt/splunk/etc/system/local/inputs.conf

/opt/splunk/etc/apps/search/local/inputs.conf

/opt/splunk/etc/apps/SplunkLightForwarder/local/inputs.conf

I also tried restarting Splunk (both on forwarder and receiver). But I'm still seeing the "ip-10-196-173-139" as the host on the receiver side when doing searches.

This is driving me crazy. Can anyone help?

Thanks! Sunny

Tags (2)

Lowell
Super Champion

For most of my systems the syslog host only contains the short form "host", and not the fully qualified domain name; which is what I want to see in splunk. So I use a transformer (like what Chris R suggests) to simply append a static domain name to my short host.

If this sounds helpful, you can check it out here:

Stephen_Sorkin
Splunk Employee
Splunk Employee

The easiest way to solve this problem is by specifying a sourcetype other than syslog in inputs.conf.

For example, try:

[monitor:///var/log/syslog]
disabled = false
host = abc.mydomain.com
sourcetype = notsyslog

For data believed to be syslog, Splunk will try to extract the host from each line. This usually is what's wanted, but that's not always the case. Chris R.'s suggestion is close, but will not work, since at the time that props.conf is consulted for this data, the host is set to abc.mydomain.com, as you configured. It's the regex mechanism that's responsible for changing it.

0 Karma

Chris_R_
Splunk Employee
Splunk Employee

Hello Sunny,

Since Splunk syslog's default extractions are taken directly from the event data, you have to override it another way. Try these settings all on your indexer(receiver).

$SPLUNK_HOME/etc/system/local/props.conf  
[host::ip-10-196-173-139]  
TRANSFORMS = newhost  

$SPLUNK_HOME/etc/system/local/transforms.conf   
[newhost]  
DEST_KEY = MetaData:Host   
REGEX = .  
FORMAT = host::newhostname.domain.com  

If you have more then just syslog data coming from this host, you may need to set a custom sourcetype on your forwarder to filter off instead of your host in props.conf. let me know how it goes.

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...