topic apache virtual hosts - custom field? in Getting Data In

apache virtual hosts - custom field?

jgauthier — Tue, 19 Nov 2013 22:18:30 GMT

I have several virtual hosts per Apache server, and I want to be able to report on them individually. I envision that I need to add a custom field, somehow, to each input for the indexer?

How could I achieve this? I would prefer all of this happen on the universalforwarder.

Thanks!

Re: apache virtual hosts - custom field?

bchoi_splunk — Mon, 28 Sep 2020 15:19:11 GMT

how is your log configured right now?

CustomLog ${APACHE_LOG_DIR}/myvirtualhost/access.log

For example, if logs from a virtual host are organized under ${APACHE_LOG_DIR}/myvirtualhost, you can add the following line to your input.conf

[monitor:///var/log/apache/myvirtualhost]
host_segment = 4

That way, "myvirtualhost" will be the host name for all log files that live under myvirtualhost.

Sorry If i misunderstood your question.

Re: apache virtual hosts - custom field?

jgauthier — Wed, 20 Nov 2013 01:06:59 GMT

That could work, but I actually want to retain the host information as the server it comes from. It could be multiple servers.

Re: apache virtual hosts - custom field?

bchoi_splunk — Wed, 20 Nov 2013 02:17:06 GMT

how about adding a field? you can add the following to your search:

| rex field=host /log/var/(?.*)/

you can also add it to your field extractor. Would this work?

Re: apache virtual hosts - custom field?

jgauthier — Wed, 20 Nov 2013 02:32:07 GMT

Oh yeah, that makes a ton of sense! I'll see what I can do with that. Thanks!