Getting Data In

Changing host for syslog

a212830
Champion

Hi,

I have syslog messages coming in from thousands of servers, and I'm using splunk to index those messages. The messages are duplicated across 3 regional servers. I need the ability to show the forwarder that processed the event. How do I do that, since I change the hostname to be the network device?

Tags (3)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

You can utilize props and transforms to grab the host metadata, before it is changed and assign it to a new field. Here is an example:

# -- props.conf
[sourcetype]
TRANSFORMS-fwd_host = forwarder_host

# -- transforms.conf
[forwarder_host]
SOURCE_KEY = MetaData:Host
REGEX = host::(.*)
DEST_KEY = _meta
FORMAT = forwarder::$1

View solution in original post

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

You can utilize props and transforms to grab the host metadata, before it is changed and assign it to a new field. Here is an example:

# -- props.conf
[sourcetype]
TRANSFORMS-fwd_host = forwarder_host

# -- transforms.conf
[forwarder_host]
SOURCE_KEY = MetaData:Host
REGEX = host::(.*)
DEST_KEY = _meta
FORMAT = forwarder::$1
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...