What is the best practice for host name extraction of syslog servers as well as the originating devices?

[adamblock2]

I have syslog servers which receive and forward log data to Splunk from a few hundred devices. I am curious what is the best/preferred way to extract the hostname of the syslog servers as well as the hostnames of the originating devices?

Should the host name of the syslog server be assigned to the Metadata host field (ie. host), with the originating devices being assigned to a different field (ie. Host or reported_hostname)?

If this is the preferred method, then a search similar to the following would not show me the status of the hosts which are sending data to syslog:

| metadata type=hosts | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")

Please advise.

Thank you.

[jeffland]

If your devices each only have data from one source, then you could place the info on the originating device in the "source" metadata field. If you need this field to distinguish different sources from the same originating device, then you could simply add another field as you mentioned. The downside to this is that it will not be available in a search such as the one you mentioned above.

If you plan on using the data frequently for summary and statistics, you could consider making it an indexed field - that way, you can use it with tstats for example.

You could also "concatenate" your info on the originating device and it's source before indexing the data, so your source field would contain "device a - source 1" while the host field only contains the syslog server info.