Getting Data In

Can we add additional parameters (IP and hostname) to the logs which are collected thorough a Windows universal forwarder?

akif_kayapinar
New Member

I am kind of new in Splunk and I am curious about something. When I install universal forwarder to a Windows server, it sends only name or ip, and by default, it sends the name of the server (can be configured with inputs.conf file). I also want to add another field that sends the ip of the server. Since not all servers are in domain, I can't find the ip address when I try to lookup from the DNS. The other thing is, since I am not a part of the systems team when i see only IP addresses, it also doesn't tell much to me. So I need both ip and hostname. Can we do it?

0 Karma

lguinn2
Legend

You can create a lookup table on the search head that will map server names to IP addresses. You can also use the built-in DNS lookup to do something similar.

But you cannot add additional information to the data that the forward sends to the indexers.

0 Karma

akif_kayapinar
New Member

Thank you for the answer. I will try the first one. Since some of the servers are not in domain and dont have a dns record, dns lookup wont do much for me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...