We have non-windows devices sending their syslog information to a Kiwi server that is hosted on a windows box.
The kiwi server is configured to filter events and write them to individual log files.
We have a universal forwarder installed on the Kiwi server with various apps deployed to the server.
Each app is configured with a local inputs.conf file to monitor a specific log file.
How do I preserve the host information from the original devices and prevent splunk from grabbing the host value from $SPLUNK_HOME\etc\system\local\inputs.conf ?
Currently some of my sourcetypes successfully do this, and the host field contains the IP address of the original device, some of my sourcetypes do not and it is incorrectly showing the Kiwi server name in the host field.
Thank you.
Had this issue in a previous environment as well. I remember Kiwi not playing nice with a few other systems. As far as I can recall, there were a few ways around it:
I can't speak to the validity of the second solution, since we just ended up putting dedicated RHEL-flavored forwarders in place to capture & send along the messages, and were gradually migrating away from Kiwi.