How to enable the forwarder to add another field (such as an alias of a host) during index time?

[bhavesh91]

Adding an index-time value on a forwarder to capture the hostnames as the host (custom name) is already added in inputs.conf/server.conf

How do we enable Splunk Forwarder to add another field such as the aliases of the host (in this case hostname) during the index-time so that we capture both the custom host and the actual hostname of the server in Splunk?

[aaraneta_splunk]

@bhavesh91 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

[woodcock]

First of all, you can only create an index-time field values from consecutive characters that already inside of the raw event. In the case of adding hostname for cases where the event only has the IP address, you are going to have to add the hostname value to the raw event. The most common and easiest way to do this is to send your events through a syslog service running a local Splunk Forwarder and to configure that service to do a reverse DNS lookup and add this to the events. There is plenty of documentation online describing how to do this, depending on which syslog server you use.

[esix_splunk]

What you want to look at is adding indexed fields at index time. Here is a document that outlines this :

https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Configureindex-timefieldextraction

Your aliases need to be in the data stream though. You can't do anytype of pre-indexing lookups or enrichment in the Splunk ingestion pipeline. So where are you getting the aliases is the big question here...

You also need to consider that adding fields at index time isn't always recommended as it can add more load to indexers. Use cases vary on this, so be aware of potential load this can add if you are doing this on thousands of hosts on already taxed indexers.