Splunk Search

How do I get the Hosts list in Search to not show syslog words as hosts?

mikeely
Path Finder

I've set up two linux machines as forwarders, and suddenly I have a very large number of entries in the hosts field which appear to simply be distinct words in the various syslog files. The host adding the vast majority of the fake hosts is running OpenSuSE 11.4, but a RHEL box also created two host entries (one upper case and one lower case). The inputs.conf for both hosts couldn't be any simpler:

[monitor:///var/log]

disabled=false

followTail=1

sourcetype=syslog

Here's a screenshot of the problem so you can see what I mean. The blurred names are actual hosts: Too many hosts

1 Solution

mikelanghorst
Motivator

I would recommend removing the "sourcetype=syslog" from your monitor stanza. Many logs under that path may not be syslog format. Telling it to treat all of these logs as a syslog file, which will extract the 4th field of the line to be the hostname.

Then if you have specific file sources, add them to props.conf entries and assign them to sourcetype=syslog.

View solution in original post

mikelanghorst
Motivator

I would recommend removing the "sourcetype=syslog" from your monitor stanza. Many logs under that path may not be syslog format. Telling it to treat all of these logs as a syslog file, which will extract the 4th field of the line to be the hostname.

Then if you have specific file sources, add them to props.conf entries and assign them to sourcetype=syslog.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...