rsyslog -> splunk UDP port 515

[jeremymiller]

Hi, I already have a syslog receiver (rsyslogd) that receives ALL syslog messages from our environment. I configured it to forward everything to 127.0.0.1 UDP port 515. Then I added a UDP Network data input in Splunk of port 515 of type syslog.

However, every event in Splunk has timestamp localhost prepended to it like so:
Sep 6 14:00:32 localhost Sep 6 14:00:32 uskyarpts08s0.mydomain.com vsftpd[4174]: warning: can't get client address: Connection reset by peer

Is there any way to make it so the original syslog host (uskyarpts08s0) is preserved as the actual source host and the localhost is not prepended?

[MarioM · Accepted solution]

you can tell splunk to not prepend in inputs.conf with no_appending_timestamp=true:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

You can override host as well with props & transforms:

props.conf

[source::udp:515]
TRANSFORMS-extract_host = hostoverride

transforms.conf:

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = ^\w+\s+\d+\s+\d+:\d+:\d+\s+\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+(\S+)
FORMAT = host::$1