Splunk Search
Highlighted

host lookup

Contributor

I'm getting some unexpected results when I run the following query for hosts:

index=mydata | top host

I expect to see a list of the top hosts in my index however I get back information such as eth0, eth1, sit0, sum, etc in my hosts column. This data is not accurate. When I click on one of the host fields to see get more information about the source, I see...

host=0.00 sourcetype=syslog source=/var/log/sa/sar15

What is causing this, and more importantly, how to stop it? Thanks in advance!

Tags (1)
Highlighted

Re: host lookup

Ultra Champion

It looks like you a monitoring a file....how are you specifying your host field extraction ?

View solution in original post

Highlighted

Re: host lookup

Contributor

I love the MARSHALL back ground!! Excellent. Regarding the host field extraction, how do I answer that? What file holds that information?

0 Karma
Highlighted

Re: host lookup

Influencer

To jump in, you should look at the inputs.conf file and "host_regex" option. So is "sar15" the host?

0 Karma
Highlighted

Re: host lookup

Ultra Champion

Correct , and there is also a "host_segment" option to consider.

Highlighted

Re: host lookup

Contributor

[monitor:///var/log]
sourcetype = syslog
disabled = false
host = myhost

That is a paragraph in my inputs.conf file. Do I just need to remove that entire paragraph?

Thanks,

Highlighted

Re: host lookup

Ultra Champion

I would change the sourcetype to something else.
ie: "mylogfile"

By using the "syslog" sourcetype , the default syslog host field transforms are getting invoked on your events.

That's why your host field is getting filled incorrectly.

from etc/system/default

props.conf

[syslog]
...
TRANSFORMS = syslog-host
...

transforms.conf

[syslog-host]
DEST_KEY = MetaData:Host
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(\w[\w.-]{2,})]?\s
FORMAT = host::$1

0 Karma
Highlighted

Re: host lookup

Contributor

sar15 is not the host, just FYI... 🙂

0 Karma