Getting Data In

How to assign the appropriate host name for udp input type for universal forwarder?

asingla
Communicator

I have a universal forwarder listening on udp:12000 for messages from various processes and relaying it to splunk indexer. Universal forwarder are receiving messages from some local processes (running on the same machine) and some from remote processes. For remote process the host name in the messages are correct i.e. the IP for those machines but for local process it's 127.0.0.1. I understand the reason as the local processes are configured with 127.0.0.1/localhost. If I change the configuration (for the local processes) with the IP of the machine, then I see the IP in the messages. Is there anyway I can configure universal forwarder to replace the localhost/127.0.0.1 with the machine IP and still retain the host name for the remote processes as it is?

MarioM
Motivator

or you could filter at the inputs.conf in your UF but you cannot have a generic udp/tcp stanza and filtered ones,you will have to set it (and maintain it) for each device.

inputs.conf:

[udp://127.0.0.1:514]
host= <host ip or name>

[udp://ip1:514]
host= <host ip or name>

...

OR

[tcp://127.0.0.1:514]
host= <host ip or name>

[tcp://ip1:514]
host= <host ip or name>

...

0 Karma

MarioM
Motivator

The problem is that Universal Forwarder doesnot do/have the following:

NO Bundles Python

NO Per-event filtering

NO Event routing

NO Event parsing

Then you will have to override the host metadata with matching regex at Indexer Level:

transforms.conf

[host_override]
DEST_KEY = MetaData:Host 
REGEX = (localhost\/127\.0\.0\.1)
FORMAT = host::<your host ip or name>

props.conf

[source::udp:514]
TRANSFORMS-localhostrename = host_override

josephnoall
Engager

I have exactly the same problem, does anyone know of a way around this? It appears from the docs that you can only manually override the host for inputs that are monitoring files or directories, but I need some way of setting the host to the local machine name for UDP/TCP inputs. (Localhost/127.0.0.1 are not very useful!)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...