I have syslog servers which receive and forward log data to Splunk from a few hundred devices. I am curious what is the best/preferred way to extract the hostname of the syslog servers as well as the hostnames of the originating devices?
Should the host name of the syslog server be assigned to the Metadata host field (ie. host), with the originating devices being assigned to a different field (ie. Host or reported_hostname)?
If this is the preferred method, then a search similar to the following would not show me the status of the hosts which are sending data to syslog:
| metadata type=hosts | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")
Please advise.
Thank you.
↧