Splunk Search

Adding Value to Host=

sdagostino
Engager

Is there a way in Splunk to add a description (type of device ie Nortel 8600) or replace the Host IP address with the equipment type or location. See search string below.

1:40:03.000 PM Jun 9 13:40:03 10.254.4.6 19263 06/09/2010 12:42:32 Syslog 0 : Failed Login Attempt: Username=69.193.186.46: Date/Time=06/09/2010 12:42:32

host=10.x.x.6 Options sourcetype=syslog Options source=udp:514 Options timestartpos=0 Options timeendpos=15 Options

Tags (2)

Genti
Splunk Employee
Splunk Employee

so, it seems to me like you are monitoring a UDP port.
Go to:

Manager » Data inputs » UDP »

And edit your UDP configuration. On the HOST section, choose Custom, and set the custom hostname, or location of the machine, or the type of device..etc.

Note that there might be a bug that prevents this from working, a small flag doesnt get set. A secure way to achieve what you want is to actually edit the inputs.conf file manually.

Find your monitor stanza for your UDP source it and edit it, it should look something like this:

[udp://514]
host = Nortel8600
sourcetype = udppackets
connection_host = none

Cheers,
.gz

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...