<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to add constant to HOST name using regular expression in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-constant-to-HOST-name-using-regular-expression/m-p/296015#M56150</link>
    <description>&lt;P&gt;There is no way to do this that I know.  I would create a link to each file in a different directory and give each the link the correct name and point the &lt;CODE&gt;monitor&lt;/CODE&gt; to the other directory.  This consumes NO extra disk space (only 1 inode per file).&lt;/P&gt;</description>
    <pubDate>Thu, 06 Jul 2017 03:32:54 GMT</pubDate>
    <dc:creator>woodcock</dc:creator>
    <dc:date>2017-07-06T03:32:54Z</dc:date>
    <item>
      <title>How to add constant to HOST name using regular expression</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-constant-to-HOST-name-using-regular-expression/m-p/296013#M56148</link>
      <description>&lt;P&gt;I am using a reg-exp to set the host name from the file path&lt;BR /&gt;
e.g. \servername\logs\application\ag_clientname_log&lt;BR /&gt;
monitor \servername\logs\application\ag_*&lt;BR /&gt;
host_regex = (ag_[^_]+)&lt;BR /&gt;
this gives me "ag_clientname"  but I want "clientname_ag_logs" to match what we had previously been collecting.&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 14:45:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-constant-to-HOST-name-using-regular-expression/m-p/296013#M56148</guid>
      <dc:creator>neilli</dc:creator>
      <dc:date>2020-09-29T14:45:48Z</dc:date>
    </item>
    <item>
      <title>Re: How to add constant to HOST name using regular expression</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-constant-to-HOST-name-using-regular-expression/m-p/296014#M56149</link>
      <description>&lt;P&gt;Hi&lt;BR /&gt;
You could use also eval&lt;BR /&gt;
| eval host=substr(host,4,15)+"_ag_logs"&lt;/P&gt;

&lt;P&gt;Bye&lt;BR /&gt;
Giuseppe &lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 14:45:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-constant-to-HOST-name-using-regular-expression/m-p/296014#M56149</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2020-09-29T14:45:51Z</dc:date>
    </item>
    <item>
      <title>Re: How to add constant to HOST name using regular expression</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-constant-to-HOST-name-using-regular-expression/m-p/296015#M56150</link>
      <description>&lt;P&gt;There is no way to do this that I know.  I would create a link to each file in a different directory and give each the link the correct name and point the &lt;CODE&gt;monitor&lt;/CODE&gt; to the other directory.  This consumes NO extra disk space (only 1 inode per file).&lt;/P&gt;</description>
      <pubDate>Thu, 06 Jul 2017 03:32:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-constant-to-HOST-name-using-regular-expression/m-p/296015#M56150</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2017-07-06T03:32:54Z</dc:date>
    </item>
  </channel>
</rss>

