Getting Data In

Two different host names for the same host

hartfoml
Motivator

I have a Linux client with a UF reporting two different formats of host name.

1) host.name.local.net
2) host.name

I looked in all input and output.conf and the server.conf and could only find the host=host.name.local.net

I noticed that in only two types of events are the hostname different.
source=/var/log/messages
source=/var/log/cron

two commands (ifconfig and sadc) are recorded in the messages log and both are failing to collect information due to permissions. these two are not the only two logs in the messages but are by far the dominant record.

The other job or item with the wrong host name is crond[21282]: (root) CMD (/usr/lib64/sa/sa1 1 1)

I don't know why these jobs are failing or why the host name is wrong.

Any sugestions?

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

This can be related to the fact that data with the syslog sourcetype will be parsed in a special way, where the host value is extracted from each individual message, i.e. there is an index-time transform that overwrites the value from inputs.conf.


UPDATE:

As for 'fixing' it, you could either
a) set another sourcetype for these inputs
b) create a new TRANSFORM that will remove the .local from the host, and call that from props.conf.

There are probably other good ways to deal with this, but it will depend on whether this a common or isolated problem

/K

View solution in original post

kristian_kolb
Ultra Champion

you're welcome.

0 Karma

hartfoml
Motivator

this seems to be the right answer. will you put it in as an answer so I can give you credit. Also if you have any suggestions on how (if you wanted to) would you fixing this issue.

Thanks for the speedy help!!!

0 Karma

kristian_kolb
Ultra Champion

This can be related to the fact that data with the syslog sourcetype will be parsed in a special way, where the host value is extracted from each individual message, i.e. there is an index-time transform that overwrites the value from inputs.conf.


UPDATE:

As for 'fixing' it, you could either
a) set another sourcetype for these inputs
b) create a new TRANSFORM that will remove the .local from the host, and call that from props.conf.

There are probably other good ways to deal with this, but it will depend on whether this a common or isolated problem

/K

hartfoml
Motivator

Thanks for the suggestions

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...