I have a forwarder sending a syslog file to the receiver. The syslog has entries like:
Jul 27 09:50:21 ip-10-196-173-139 postfix .....
And I don't want the "ip-10-196-173-139" to show up as the "host" on the receiver when doing searches. So I edited the "inputs.conf" like this:
[default] host = abc.mydomain.com [monitor:///var/log/syslog] disabled = false host = abc.mydomain.com
I did this in a bunch of places since nothing seemed to work:
I also tried restarting Splunk (both on forwarder and receiver). But I'm still seeing the "ip-10-196-173-139" as the host on the receiver side when doing searches.
This is driving me crazy. Can anyone help?
For most of my systems the syslog host only contains the short form "host", and not the fully qualified domain name; which is what I want to see in splunk. So I use a transformer (like what Chris R suggests) to simply append a static domain name to my short host.
If this sounds helpful, you can check it out here:
The easiest way to solve this problem is by specifying a
sourcetype other than
For example, try:
[monitor:///var/log/syslog] disabled = false host = abc.mydomain.com sourcetype = notsyslog
For data believed to be syslog, Splunk will try to extract the host from each line. This usually is what's wanted, but that's not always the case. Chris R.'s suggestion is close, but will not work, since at the time that
props.conf is consulted for this data, the
host is set to
abc.mydomain.com, as you configured. It's the regex mechanism that's responsible for changing it.
Since Splunk syslog's default extractions are taken directly from the event data, you have to override it another way. Try these settings all on your indexer(receiver).
$SPLUNK_HOME/etc/system/local/props.conf [host::ip-10-196-173-139] TRANSFORMS = newhost $SPLUNK_HOME/etc/system/local/transforms.conf [newhost] DEST_KEY = MetaData:Host REGEX = . FORMAT = host::newhostname.domain.com
If you have more then just syslog data coming from this host, you may need to set a custom sourcetype on your forwarder to filter off instead of your host in props.conf. let me know how it goes.