Getting Data In

Can I set a different connection_host value for a specific set of remote servers?

ctaf
Contributor

Hi,

I have a inputs.conf with splunktcp-ssl stanza.
The connection_host is equals to "dns".
But I would like it to be "none" for some remote servers (Splunk UF sending to this splunktcp-ssl).

Is it possible to keep only one splunk-TCP port open with 2 differents behavior on "connection_host" depending on which IP is sending data? (by tuning "acceptFrom" maybe)

Thanks

0 Karma

FrankVl
Ultra Champion

Normally the host is set at the initial forwarder receiving the data, not at a secondary forwarder or the indexer receiving the data on a splunktcp input. The connection_host setting only has an effect if the original forwarder did not set the host field.

Can you perhaps elaborate your situation a bit and why you are using this setting on a splunktcp input? Perhaps that can point us into directions to solve it 🙂

0 Karma

ctaf
Contributor

Hi Frank, are you sure that connection_host has no effect if the original forwarder set host field already?
Because I used to have connection_host= dns and I had a lot of DNS request by this intermediate forwarder even though all my original UF have got the host field set...

0 Karma

FrankVl
Ultra Champion

That's how I interpret the inputs.conf spec:

connection_host = [ip|dns|none]
* For splunktcp, the host or connection_host will be used if the remote Splunk
  instance does not set a host, or if the host is set to "<host>::<localhost>".

Not sure how Splunk exactly works, it may still do the DNS lookup, but then decide not to use the result?

0 Karma

deepashri_123
Motivator

Hey@ctaf,

Are you trying to filter events and take data only for particular events?Then refer this link:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Discard_specific_e...

Also refer this link for hostname:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Setadefaulthostforaninput

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...