Deployment Architecture

Can I get the instance.cfg GUID for an indexed event?

jimcroft
Explorer

Hi all

I'm trying to deal with an issue where hostnames are not unique but are forwarding to the same Splunk indexer.

I know every Splunk instance should have a unique GUID. Is there a way of finding the GUID of the Splunk instance that generated an event?

Thanks

Jim

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm fairly certain the forwarder's GUID isn't stored for an event.

If you're flexible about your configuration and not worried about mild performance impacts you could however create your own GUID storage.
Here's a rough draft:

  • Change every forwarder's host from <oldhost> to <oldhost>---<GUID>
  • Use transforms.conf to extract <GUID> from the host field and write it to an indexed field called GUID
  • Use transforms.conf to revert the host to <oldhost>

That should be transparent to your existing reports/alerts.

jimcroft
Explorer

We're using a mix. I know to use transforms like this we'll need to replace the universals with heavies but that's not a major hurdle.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you using universal or heavy forwarders?

0 Karma

jimcroft
Explorer

Thanks! I'd just started reading up on indexed fields. The performance hit warning is a concern but certainly a good place to start and we can test the impact.

What I was also thinking, instead of changing hostnames which can't happen here for various reasons, is something like this in transforms.conf...

[] <--- empty or perhaps source::* whatever to make this match all events
REGEX = .*
FORMAT = guid::""
WRITE_META = true

The ID here would be hardcoded into the conf file rather than using $1 from a regex match. Does that sound like a sensible option? Thanks again.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...