Monitoring Splunk

Splunk is not extracting the correct host name from the secure file

jasicklick
New Member

We are forwarding the messages and secure file to our Splunk server via rsyslog. The files for each server are placed in a separate directory (/var/log/remote/year/month/day/server_name/messages and secure) and ingested into Splunk. Splunk is extracting the correct host name from the messages file, but not the secure file. Each of these files has the same format in regards to date and host name, but for some reason Splunk is assigning the value "splunkserver" as the host name for the contents of the secure file.

Tags (1)
0 Karma

ontkanin
Path Finder

Add host_segment into your monitor input stanza(s).

For example:

[monitor:///var/log/remote/year/month/day/server_name/messages]
host_segment = 7
index = your_index
sourcetype = your_messages_sourcetype
disabled = 0

[monitor:///var/log/remote/year/month/day/server_name/secure]
host_segment = 7
index = your_index
sourcetype = your_secure_sourcetype
disabled = 0

It will use server_name (7th segment) from /var/log/remote/year/month/day/server_name/messages as a host name value.

0 Karma

somesoni2
Revered Legend

Since Splunk is extracting the host name from the file content, could you provide content of props.conf and transforms.con for these logs, based on sourcetype/source? Also, provide some sample log entries from both logs to validate the configuration. Scrub any sensitive data before posting the sample logs.

Another option, since your log location has a server name, why don't you capture the host using host_segment property in inputs.conf? provided they are the same.

0 Karma

sjaworski
Communicator

What does your monitor stanza in your inputs.conf file look like?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...