Merge pull request #476 from splunk/fix/cisco-nohost

Update cisco_syslog.conf
CSVD · May 19, 2020 · 2ad58c9 · 2ad58c9
2 parents e63e8f5 + 8744a48
commit 2ad58c9
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/package/etc/conf.d/filters/cisco/cisco_syslog.conf b/package/etc/conf.d/filters/cisco/cisco_syslog.conf
@@ -67,6 +67,11 @@ parser cisco-parser-ex{
                     "${12}",
                     value("MESSAGE")                
                 );
+                set(
+                    "${HOST_FROM}"
+                    value("HOST")
+                    condition(not host("."))
+                );                
             };
             parser { date-parser-nofilter(format(
                 '%b %d %H:%M:%S.%f',