Splunk Search

host lookup

DTERM
Contributor

I'm getting some unexpected results when I run the following query for hosts:

index=mydata | top host

I expect to see a list of the top hosts in my index however I get back information such as eth0, eth1, sit0, sum, etc in my hosts column. This data is not accurate. When I click on one of the host fields to see get more information about the source, I see...

host=0.00 sourcetype=syslog source=/var/log/sa/sar15

What is causing this, and more importantly, how to stop it? Thanks in advance!

Tags (1)
1 Solution

Damien_Dallimor
Ultra Champion

It looks like you a monitoring a file....how are you specifying your host field extraction ?

View solution in original post

Damien_Dallimor
Ultra Champion

It looks like you a monitoring a file....how are you specifying your host field extraction ?

DTERM
Contributor

sar15 is not the host, just FYI... 🙂

0 Karma

Damien_Dallimor
Ultra Champion

I would change the sourcetype to something else.
ie: "my_log_file"

By using the "syslog" sourcetype , the default syslog host field transforms are getting invoked on your events.

That's why your host field is getting filled incorrectly.

from etc/system/default

props.conf

[syslog]
...
TRANSFORMS = syslog-host
...

transforms.conf

[syslog-host]
DEST_KEY = MetaData:Host
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(\w[\w.-]{2,})]?\s
FORMAT = host::$1

0 Karma

DTERM
Contributor

[monitor:///var/log]
sourcetype = syslog
disabled = false
host = myhost

That is a paragraph in my inputs.conf file. Do I just need to remove that entire paragraph?

Thanks,

Damien_Dallimor
Ultra Champion

Correct , and there is also a "host_segment" option to consider.

MHibbin
Influencer

To jump in, you should look at the inputs.conf file and "host_regex" option. So is "sar15" the host?

0 Karma

DTERM
Contributor

I love the MARSHALL back ground!! Excellent. Regarding the host field extraction, how do I answer that? What file holds that information?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...