Getting Data In

Heavy Forwarder sending incorrect Host

adelucaa
New Member

We have a heavy forwarder set up on our log server. It is sending to rsyslog and then forwarding to the indexer.

If I send it directly from the forwarder to the indexer, then I receive the log server as the host field. If I send it through to the rsyslog, then I receive localhost in in the host field.

This is our config on the heavy forwarder:

outputs.conf

[syslog:syslog_group]
server = IndexerIP:514
type = tcp
inputs.conf
[tcp://:9997]

props.conf

[host::*]
TRANSFORMS-sys = syslogrouting

transforms.conf

[syslogrouting]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslog_group

The indexer is set to receive in syslog format.

0 Karma

grijhwani
Motivator

Simple answer: don't use Splunk's syslog service. Use syslog-ng (or something like) and use Splunk to then sweep those logs. syslog-ng can be tailored to store logs based on hostname, ip address, date, etc., which then makes granular indexing within Splunk a doddle.

0 Karma

adelucaa
New Member

After the heavy forwarder, we send to rsyslog(which we would like to be receiving in syslog format). We only use the heavy forwarder, because we need to receive from the light forwarders and forward to the syslog. How would I set the heavy forwarder to forward, but not index? Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...