Splunk Search

Adding Value to Host=

sdagostino
Engager

Is there a way in Splunk to add a description (type of device ie Nortel 8600) or replace the Host IP address with the equipment type or location. See search string below.

1:40:03.000 PM Jun 9 13:40:03 10.254.4.6 19263 06/09/2010 12:42:32 Syslog 0 : Failed Login Attempt: Username=69.193.186.46: Date/Time=06/09/2010 12:42:32

host=10.x.x.6 Options sourcetype=syslog Options source=udp:514 Options timestartpos=0 Options timeendpos=15 Options

Tags (2)

Genti
Splunk Employee
Splunk Employee

so, it seems to me like you are monitoring a UDP port.
Go to:

Manager » Data inputs » UDP »

And edit your UDP configuration. On the HOST section, choose Custom, and set the custom hostname, or location of the machine, or the type of device..etc.

Note that there might be a bug that prevents this from working, a small flag doesnt get set. A secure way to achieve what you want is to actually edit the inputs.conf file manually.

Find your monitor stanza for your UDP source it and edit it, it should look something like this:

[udp://514]
host = Nortel8600
sourcetype = udppackets
connection_host = none

Cheers,
.gz

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...