topic Re: inputs.conf segment setting in Getting Data In

inputs.conf segment setting

plumainwfs — Sun, 12 Mar 2017 16:53:40 GMT

Not sure why the hostname for the monitor stanza below is not being parsed out...

directory is as follows:
/mnt/log/files/2017/month/day/HOSTNAME/auth.logs

i would have thought by adding a stanza segment=7 will pull the following hostnames: servera, serverb, serverc... and so forth.

[monitor:///mnt/log/files/2017/03/(05|06|07|08|09)/.../auth.log.gz]
whitelist=servera|serverb|serverc|serverd|servere|serverf
segment=7
index=temp
sourcetype=nix:auth

Not sure what do I have to change here to get this to have the hostname, instead it is pulling the hostname for the local logserver.

Re: inputs.conf segment setting

jkat54 — Sun, 12 Mar 2017 17:24:46 GMT

Its called host_segment not segment...

from inputs.conf:

host_segment = <integer>
* If set to N, the Nth "/"-separated segment of the path is set as host. If
  host_segment=3, for example, the third segment is used.
* If the value is not an integer or is less than 1, the default "host ="
  setting is used.
* Defaults to unset.

Re: inputs.conf segment setting

jkat54 — Thu, 18 Jul 2019 12:21:54 GMT

@plumainwfs can you come back to this answer and let us know if it solves your problem by accepting an answer or adding more details?