https://community.splunk.com/t5/Splunk-Dev/get-host-from-fileshare/m-p/20386#M162 <P>Could you try host_regex like as bellow? It will work for your requirement. </P> <P>[monitor://xxxxxxxxxxx]<BR /> host_regex = (server\d+)</P> Tue, 22 Nov 2011 05:13:48 GMT Takajian 2011-11-22T05:13:48Z https://community.splunk.com/t5/Splunk-Dev/get-host-from-fileshare/m-p/20385#M161 <P>Hello,<BR /> I have multiple inputs.conf entries<BR /> ...<BR /> [monitor://\\server1\share$\mylog.log]<BR /> sourcetype = MYLOG<BR /> index = mylog<BR /> host_segment = 1<BR /> ...<BR /> this creates host = share$ on index server...<BR /> changing to host_segment = 0 did not work.<BR /> how can I get hostname out of fileshare (\\server\share$\log)?</P> <P>please help.</P> <P>thank you.</P> Mon, 28 Sep 2020 10:08:04 GMT https://community.splunk.com/t5/Splunk-Dev/get-host-from-fileshare/m-p/20385#M161 nurtdi 2020-09-28T10:08:04Z https://community.splunk.com/t5/Splunk-Dev/get-host-from-fileshare/m-p/20386#M162 <P>Could you try host_regex like as bellow? It will work for your requirement. </P> <P>[monitor://xxxxxxxxxxx]<BR /> host_regex = (server\d+)</P> Tue, 22 Nov 2011 05:13:48 GMT https://community.splunk.com/t5/Splunk-Dev/get-host-from-fileshare/m-p/20386#M162 Takajian 2011-11-22T05:13:48Z https://community.splunk.com/t5/Splunk-Dev/get-host-from-fileshare/m-p/20387#M163 <P>Thank you for your answer. Although it did not work... <BR /> The solution was quite simple - I just needed to use static host = server1 in each stanza.<BR /> Thanks.</P> Tue, 22 Nov 2011 12:59:13 GMT https://community.splunk.com/t5/Splunk-Dev/get-host-from-fileshare/m-p/20387#M163 nurtdi 2011-11-22T12:59:13Z