Getting Data In

Retrieving logs from all hosts in Splunk cloud, instead of one

VijaySrrie
Builder

Hi,

Tanium is sending logs to our only syslog server and we have created a folder in that server (let us say a) so in Splunk cloud it should show as host = a, but in Splunk cloud, we could see hostname containing different syslog servers. Is it a bug?

0 Karma

woodcock
Esteemed Legend

Yes, this is normal default behavior but it is definitely incorrect for your use case. You need to override the host value and take it from inside of the event or from the connection. See here for how we do it:
http://www.georgestarcher.com/splunk-success-with-syslog/

0 Karma

diogofgm
SplunkTrust
SplunkTrust

It depends on how the data is being handled during index time. You can change the host field in index time with props/transforms confs and you can also set the host as a segment of the path your monitoring.

Several TAs bring some kind of field manipulation out of the box (e.g. you index data with source type pan_logs and it ends up as pan:traffic, pan:system, etc). Same logic can be applied to other fields in index time (e.g. index (for data routing), host (to correctly assign the host name), etc. )

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...