topic Re: Can I Assign to Host The Value From A Variable? in Getting Data In

Can I Assign to Host The Value From A Variable?

attoriozi — Wed, 03 Nov 2010 06:02:11 GMT

I would like to assign to "host" a variable initiated in the input script.

For instance, is it possible something like this:

[script://./bin/hostrandom.sh]

interval = 10

host = $RHOST

sourcetype = hostrandom

disabled = 0

where

cat ../bin/hostrandom.sh

export RHOST=HOST$RANDOM

echo "This is the Event for $RHOST "

Re: Can I Assign to Host The Value From A Variable?

gkanapathy — Wed, 03 Nov 2010 06:27:20 GMT

You can't do this based on a value that is set in the scripted input, though you can use a variable that is set in the environment in which the Splunk process runs. However, if you have a scripted input, there are other ways to set the host by having the script itself output a field that can be transformed at index time, or by using dynamic metadata assignment

Re: Can I Assign to Host The Value From A Variable?

attoriozi — Wed, 03 Nov 2010 06:45:57 GMT

Documentation is not very clear. I think it just suggests a script like: << echo "This is the Event for host=RHOST$RANDOM " >>

Re: Can I Assign to Host The Value From A Variable?

attoriozi — Wed, 03 Nov 2010 07:01:39 GMT

basically doing the above and then use a index time extraction. Ok thanks

Re: Can I Assign to Host The Value From A Variable?

attoriozi — Wed, 03 Nov 2010 07:57:27 GMT

still not good: in my case the input script generates an event that needs to be split in multiple events (SHOULD_LINEMERGE=true). In this case only one of those events is going to be associated to the extracted host, all the other are going to be associated to default host.

Re: Can I Assign to Host The Value From A Variable?

gkanapathy — Mon, 28 Sep 2020 09:20:18 GMT

Don't use should_linemerge = true. Use SHOULD_LINEMERGE = false and a unique LINE_BREAKER pattern between events.