I have the following in inputs.conf:
[udp://32004] host = custom_host connection_host = none sourcetype = custom_sourcetype index = custom_index no_appending_timestamp = true
Here is the btool output:
system [udp://32004] system _rcvbuf = 1572864 system connection_host = none system host = custom_host system index = custom_index system no_appending_timestamp = true system sourcetype = custom_sourcetype
Yet, my "host" setting is being set to the IP address of the sending host. Also should point out that the "connection_host" setting was added after discovering this issue (since the documentation for inputs.conf indicates that the default is to assign IP of the connecting host) but it had no effect. However, setting connection_host to "dns" does "correctly" resolve to the fqdn of the connecting host.
Is your sourcetype 100% custom, or is it based on the default syslog
or syslog-like sourcetypes? Also, is no_appending_timestamp
working for you? With it set to true
your data should arrive with no timestamp or hostname in Splunk (unless another upstream syslog has added one), so in that case connection_host
should be irrelevant.
Otherwise, the syslog
sourcetypes will extract the hostname from the syslog timestamp/hostname at the beginning of the line and set host to that, overriding whatever else is specified. If you are appending the timestamp (and host) then that could be happening. Then again, it seems that your config should be allowing that to happen.
Okay, then basically, you probably need to kill the default TRANSFORM that comes with the default syslog
sourcetype, i.e., TRANSFORMS =
and/or TRANSFORMS-host =
, i.e., set them to blank so they don't override the input-specified hostname.
sourcetype: variation of the syslog with specific field extraction. I started with sourcetype=syslog though.
no_appending_timestamp: yep, works fine. The source systems are already adding the timestamp, I wanted to add host manually. Right now, I was trying to do this with host = hostname but it's not taking. Setting connection_host = dns is the only way I've gotten this to kinda work (ie, use the hostname rather than the IP address).