Getting Data In

Can you override host for an input?

juniormint
Communicator

I have an input like the below. When I search for events from that input they have host=127.0.0.1. The app sending the events to the input is on the same host, so from the forwarders perspective the messages are from 127.0.0.1.

Anyway, it makes sense why I get the value that is currently there, but it is not particularly informative.

Any suggestions for how / where to override host?

Can I override it in inputs.conf? I cannot seem to find what exactly to put below (if its even possible).

excerpt from inputs.conf

[tcp://12345]
connection_host = dns
sourcetype = log4j
source = mysource
host = ????

0 Karma

chris
Motivator

This is possible

[tcp://12345]
connection_host = dns
sourcetype = log4j
source = mysource
host = myStaticHostValue

If there is more than one host/server sending data to your tcp port you can use a regex to get the host field from the events (if the host is logged in the event somewhere which is probably not the case for standard log4j logs) you have to configure this in props.conf & transforms.conf (you create those files in $SPLUNK_HOME/etc/system/local:

props.conf

 [source::mysource]
TRANSFORMS-ho=hostoverride

transforms.conf (>> info about transforms.conf)

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = \s(\w*)$
FORMAT = host::$1
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...