Hi @smichalski , I’m a Community Moderator in the Splunk Community. This question was posted 4 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

We would also need this information in splunk. Does anyone can confirm if it is feasible (and how) or definitely not? ... View more

Hello Giuseppe Thanks so much for your help. I edited my search to add the index and more important to add your suggested command and it works a treat. really appreciate your taking the time to help me get this sorted. have a great day! Will ... View more

hello to4kawa thanks so much for your help. that did the trick. using your search as a base I simply added a table to eliminate a few of the fields we do not need and renamed the fields to simpler ones for our needs and it worked great! very much appreciated. I do wish I could give some points to spitchika as well. the solutions offered by spitchika (though a different approach from your solution) really got me close. but in the end yours really worked great and displays everything accurately and just what we needed. thanks so much for your help. I have created a lot of alerts for our business but still learning a LOT as regex is very hard to get my head around. kind regards and thanks again! Will ... View more

glad you solved it 🙂 ... View more

Glad you were able to resolve this. Happy Splunking! PS: You can accept your answer to mark this question complete. ... View more

Hello, when using syslog-ng with splunk you can control the index and sourcetype etc in the app inputs.conf that is pushed to your forwarder. of course this implies you are using a splunk enterprise on prem deployment server to push apps to your endpoints forwarders. for example firewall sends its log to syslog-ng syslog-ng.conf has filters configured for each type of device sending logs, it checks through those filters until it finds a match for the log received from the firewall. lets say it is using subnet to identify this is a firewall. once it matches the filter it then checks the log rule which tells it which destination rule to use to place the log in the folder structure and naming convention that has been configured in the destination rule for this device type lets say it puts the log in "/home/syslog/logs/firewall/$HOST/$YEAR-$MONTH-$DAY-firewall.log" you will note that in the path that is configured in the destination rule for this log the hostname will be the 5th folder in the path so in your inputs.conf file for whichever app you use for this devicetypes logs you would need to tell it that the 5th position is where the hostname is. splunk will then be able to find the logs using that name with the host=host name example in my example the syslog_firewall_inputs\local\ inputs.conf file would look like this Firewall Logs sent to syslog-ng [monitor:///home/syslog/logs/firewall//.log] host_segment = 5 sourcetype = fgt_log index = firewall disabled = false note that the sourcetype was one we created ourselves for our environment so be sure all settings are for your own environment. as you can see it is in this file where you can specify which index and which sourcetype splunk UF will associate with the log. I hope this is helpful. your description was not 100% clear so I am hoping this is what you need ... View more