topic Re: host name extraction for multiple types of logs in Getting Data In

host name extraction for multiple types of logs

spatil — Tue, 05 Apr 2011 16:59:48 GMT

Hi ,

I have two different types of logs, performance logs and alert logs. for performance logs , I have a folder structure as follows, \Splunk\etc\apps\myApp\logs\log_sample\host1\gn1*.cvs \Splunk\etc\apps\myApp\logs\log_sample\host2\gn2*.cvs \Splunk\etc\apps\myApp\logs\log_sample\host3\gn3*.cvs

here, host1, host2, and host3 are my host names. I managed to extract above host names using "host_segment" in inputs.conf.

Now, for alert logs I have a below directory structure. \Splunk\etc\apps\myApp\logs\AlertLogs*.csv For all these alert logs I need a static hostname say "alert".

How can I configure Inputs.conf to handle above situation ?

Regards, S.

Re: host name extraction for multiple types of logs

jgauthier — Tue, 05 Apr 2011 21:38:39 GMT

on the input stanza, i believe you can set it explicity:

host=alert

I am doing that with my firewall logs, so the host is set to be the city location.

Re: host name extraction for multiple types of logs

spatil — Wed, 06 Apr 2011 12:54:00 GMT

I have already added below lines in inputs.conf, still it is not working host_segment=7 [source::...AlertLogs...] host=alert

Re: host name extraction for multiple types of logs

jgauthier — Wed, 06 Apr 2011 20:27:10 GMT

What is the host showing up as? You probably want to remove the host_segment here, it's not necessary.