Merge pull request #474 from splunk/fix/cisco-bad-host

Fix incorrect population of host in cisco_syslog sourcetype when host is not in the event
CSVD · May 19, 2020 · c102bb7 · c102bb7
2 parents 220c37b + e483a89
commit c102bb7
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/package/etc/conf.d/filters/cisco/cisco_syslog.conf b/package/etc/conf.d/filters/cisco/cisco_syslog.conf
@@ -36,6 +36,11 @@ parser cisco-parser-ex{
                     "${6}",
                     value("MESSAGE")                
                 );
+                set(
+                    "${HOST_FROM}"
+                    value("HOST")
+                    condition(not host("."))
+                );
             };
         } else {
             # All other cisco syslog