I have several lightweight forwarders collecting syslog data from files in their respective /var/log/ directories and forwarding it all to one indexer.
For some of them, the hostname written in the files of /var/log/ differs from the system hostname (uname -n) set for the forwarder. This is intended.
I would like my indexer to always set the value of the "host" field of those events to the hostname of the forwarder sending them, NOT to extract that value from the contents of the file.
How can I achieve this?
The value of the "host" field for events of the "syslog" sourcetype is extracted using the "syslog-host" transform.
The transform is called in $SPLUNK_HOME/etc/system/default/props.conf :
[syslog] pulldown_type = true maxDist = 3 TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 32 TRANSFORMS = syslog-host REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False
The index-time filed extraction transform is defined $SPLUNK_HOME/etc/system/default/transforms.conf.
The easiest way to prevent that extraction from happening is to suppress the call of the transform by populating the $SPLUNK_HOME/etc/system/local/props.conf file in the following way :
[syslog] TRANSFORMS =
This will result in the following effective configuration stanza for props.conf, which shows we have overwritten the TRANSFORMS used for the "syslog" sourcetype :
# $SPLUNK_HOME/bin/splunk cmd btool props list syslog --debug system [syslog] system BREAK_ONLY_BEFORE = system BREAK_ONLY_BEFORE_DATE = True system CHARSET = UTF-8 system DATETIME_CONFIG = /etc/datetime.xml (...) system TIME_FORMAT = %b %d %H:%M:%S system TRANSFORMS = system TRUNCATE = 10000 system maxDist = 3 system pulldown_type = true
After a restart of Splunk, the indexer will use the source ip/hostname of the forwarder that sent that data to populate the "host" field.
The value of the "host" field for events of the "syslog" sourcetype is extracted using the "syslog-host" transform.
The transform is called in $SPLUNK_HOME/etc/system/default/props.conf :
[syslog] pulldown_type = true maxDist = 3 TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 32 TRANSFORMS = syslog-host REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False
The index-time filed extraction transform is defined $SPLUNK_HOME/etc/system/default/transforms.conf.
The easiest way to prevent that extraction from happening is to suppress the call of the transform by populating the $SPLUNK_HOME/etc/system/local/props.conf file in the following way :
[syslog] TRANSFORMS =
This will result in the following effective configuration stanza for props.conf, which shows we have overwritten the TRANSFORMS used for the "syslog" sourcetype :
# $SPLUNK_HOME/bin/splunk cmd btool props list syslog --debug system [syslog] system BREAK_ONLY_BEFORE = system BREAK_ONLY_BEFORE_DATE = True system CHARSET = UTF-8 system DATETIME_CONFIG = /etc/datetime.xml (...) system TIME_FORMAT = %b %d %H:%M:%S system TRANSFORMS = system TRUNCATE = 10000 system maxDist = 3 system pulldown_type = true
After a restart of Splunk, the indexer will use the source ip/hostname of the forwarder that sent that data to populate the "host" field.