Can you help me rewrite the hostname of syslog data being sent to SplunkCloud?


I am currently migrating to the cloud but struggling to get the data in the cloud correctly. I have a Kiwi sylog server and a forwarder that is getting the data to the cloud, but it shows up with the incorrect host and source type. I have edited the inputs.conf to fix the source type to syslog, and that changes the hostname from the ip address of the syslog server to the facility in the message. I just need it to go one tab to the right.

Any ideas? Below is an example of how the data is formatted when sent from Kiwi.

2018-11-06 16:20:23 Local7.Notice  
Labels (1)
Tags (2)


Are you writing the hostname to the directory where logs are being written in Kiwi?

For example, C:\Program Files\Kiwi\firewall\HOSTNAME\ logfile.txt

If so, you can set host_segment in your inputs.conf.

In my example, your host_segment would be 4. So it would take the 4th entry from your path and make that the hostname

0 Karma


Yes I am actually doing that for my firewalls already and that works fine using host_segment. Was hoping to be able to leave all my switches in one location instead of making hundreds of directories. Its obviously expecting host where Kiwi puts facility. Havent found a way to change that on the Kiwi side yet so was hoping Splunk had something I was unaware of. Previously we sent everything direct to splunk when it was on prem but couldnt continue that when we went to splunk cloud. Thanks.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...