topic Re: host_regex help in Splunk Enterprise

host_regex help

a212830 — Tue, 11 Feb 2014 14:31:09 GMT

Hi,

I need to set the host field, based upon the hostname in my file. I know that this is done via host_regex, but I need help with the regex.

The files all begin with system-nx and end with .log. Almost anything can be between the nx and the .log

For example:

system-nx247sa.log
system-nxtest.log
system-nx27abc.log

Re: host_regex help

MuS — Tue, 11 Feb 2014 14:41:49 GMT

Hi a212830,

based on the provided examples, something like this should work for you:

 \-nx(?<myHost>.+)\.log

hope this helps ...

cheers, MuS

Re: host_regex help

a212830 — Tue, 11 Feb 2014 14:46:49 GMT

Thanks. I'm not looking to do this in the search bar, but rather in the inputs.conf via host_regex, using a forwarder.

Re: host_regex help

a212830 — Tue, 11 Feb 2014 15:01:40 GMT

This was my attempt:

[monitor:///apps/logs/*/*/*/system-nx*.log]
recursive  = Yes
index=perfstats
sourcetype = lcs_syslog
followTail = 0
disabled = 0
host_regex = "/apps/logs/*/*/*/system-(NnXx\w+[a-zA-Z0-9][.]log"

Re: host_regex help

kristian_kolb — Tue, 11 Feb 2014 15:33:50 GMT

Aah, it does not really work that way. The asterisk in the [monitor] does not behave like normal regex. It actually translates to [^/\\]*, i.e. match any number of characters as long as they are not slash or backslash.

This also means that your host_regex will fail, since there, the asterisk takes its normal meaning, i.e. match the preceding character zero or more times.

Also, you do not have a correctly defined capturing group in the regex.

Try this instead (includes the "nx" part):

host_regex = \/system-(.+)\.log$

Re: host_regex help

a212830 — Thu, 13 Feb 2014 01:55:18 GMT

Thanks - this worked. Is the host_regex including the path of the file in it's parsing?

Re: host_regex help

kristian_kolb — Thu, 13 Feb 2014 10:08:17 GMT

Yes, the host_regex operates on the source field.

Re: host_regex help

a212830 — Wed, 26 Feb 2014 11:34:30 GMT

This is working great, but I noticed that it doesn't parse on some values - if they have multiple dashes, for example (wasn't expecting that).

system-abc-twus601m-b2.log

Re: host_regex help

MuS — Wed, 26 Feb 2014 11:43:11 GMT

what would be the host name then, abc-twus601m-b2 or twus601m-b2?

Re: host_regex help

a212830 — Wed, 26 Feb 2014 11:54:37 GMT

abc-twus601m-b2. Basically, anything after the system- to .log. I can't control what is there, so it could include dashes and underscores, and be any case.

Re: host_regex help

MuS — Wed, 26 Feb 2014 12:11:09 GMT

/k regex should still be valid, but maybe .log is not the end of the string? Can you try this:

(?<=system\-)(.+)(?=\.log)

btw, you can play around with your data here http://regexr.com/ 😉

Re: host_regex help

a212830 — Wed, 26 Feb 2014 12:26:29 GMT

Thanks. I've tried the regexr.com site, but it's not very useful. It doesn't really say how to use it. Probably me...