<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic During import CSV, how do I use a host_segment attribute to extract a host name? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378809#M68499</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I import a CSV file like this one :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;date;host;type
18/09/18 10:23:50;SERV1;file
18/09/18 10:23:52;SERV2;serv
18/09/18 10:24:50;SERV3;file
18/09/18 10:30:50;SERV4;file
18/09/18 10:33:50;SERV5;file
18/09/18 10:33:55;SERV6;computer
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Detected like this :&lt;BR /&gt;
&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5783i714146AE3EEDCB2C/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;I try segment number : 2 &lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5784i2AD5BE55C20C1B8F/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;But at the end, I have&lt;BR /&gt;
extracted_host =    SERVX   &amp;lt;- It is ok&lt;BR /&gt;
host =  127.0.0.1   &amp;lt;- All the line have the same host : 127.0.0.1&lt;/P&gt;

&lt;P&gt;Is this normal ? And how could I have host valer with the name of the computer list in the CSV ?&lt;/P&gt;</description>
    <pubDate>Wed, 19 Sep 2018 10:11:44 GMT</pubDate>
    <dc:creator>pmorlon</dc:creator>
    <dc:date>2018-09-19T10:11:44Z</dc:date>
    <item>
      <title>During import CSV, how do I use a host_segment attribute to extract a host name?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378809#M68499</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I import a CSV file like this one :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;date;host;type
18/09/18 10:23:50;SERV1;file
18/09/18 10:23:52;SERV2;serv
18/09/18 10:24:50;SERV3;file
18/09/18 10:30:50;SERV4;file
18/09/18 10:33:50;SERV5;file
18/09/18 10:33:55;SERV6;computer
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Detected like this :&lt;BR /&gt;
&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5783i714146AE3EEDCB2C/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;I try segment number : 2 &lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5784i2AD5BE55C20C1B8F/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;But at the end, I have&lt;BR /&gt;
extracted_host =    SERVX   &amp;lt;- It is ok&lt;BR /&gt;
host =  127.0.0.1   &amp;lt;- All the line have the same host : 127.0.0.1&lt;/P&gt;

&lt;P&gt;Is this normal ? And how could I have host valer with the name of the computer list in the CSV ?&lt;/P&gt;</description>
      <pubDate>Wed, 19 Sep 2018 10:11:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378809#M68499</guid>
      <dc:creator>pmorlon</dc:creator>
      <dc:date>2018-09-19T10:11:44Z</dc:date>
    </item>
    <item>
      <title>Re: During import CSV, how do I use a host_segment attribute to extract a host name?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378810#M68500</link>
      <description>&lt;P&gt;"Segment number" refers to a portion of the source's file path.  If the source is "&lt;A href="http://127.0.0.1/foo/bar"&gt;http://127.0.0.1/foo/bar&lt;/A&gt;" then segment 2 would be correctly set to "127.0.0.1".&lt;BR /&gt;
What result do you expect?  Perhaps we can help you achieve that result.&lt;/P&gt;</description>
      <pubDate>Wed, 19 Sep 2018 11:18:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378810#M68500</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2018-09-19T11:18:51Z</dc:date>
    </item>
    <item>
      <title>Re: During import CSV, how do I use a host_segment attribute to extract a host name?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378811#M68501</link>
      <description>&lt;P&gt;Thank Richgalloway for your answer.&lt;/P&gt;

&lt;P&gt;I have this result :&lt;/P&gt;

&lt;P&gt;&lt;IMG src="https://ibb.co/gFwCGe" alt="alt text" /&gt;&lt;/P&gt;

&lt;P&gt;And i want to have in the Host the same result that extracted_host : SERVX&lt;/P&gt;

&lt;P&gt;Is it possible ?&lt;/P&gt;</description>
      <pubDate>Wed, 19 Sep 2018 11:46:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378811#M68501</guid>
      <dc:creator>pmorlon</dc:creator>
      <dc:date>2018-09-19T11:46:43Z</dc:date>
    </item>
    <item>
      <title>Re: During import CSV, how do I use a host_segment attribute to extract a host name?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378812#M68502</link>
      <description>&lt;P&gt;The &lt;A href="https://ibb.co/gFwCGe"&gt;picture&lt;/A&gt; was not include : &lt;A href="https://ibb.co/gFwCGe"&gt;https://ibb.co/gFwCGe&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 19 Sep 2018 11:48:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378812#M68502</guid>
      <dc:creator>pmorlon</dc:creator>
      <dc:date>2018-09-19T11:48:08Z</dc:date>
    </item>
    <item>
      <title>Re: During import CSV, how do I use a host_segment attribute to extract a host name?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378813#M68503</link>
      <description>&lt;P&gt;Assignment of host name is done before lookups.&lt;/P&gt;</description>
      <pubDate>Wed, 19 Sep 2018 13:56:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378813#M68503</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2018-09-19T13:56:30Z</dc:date>
    </item>
    <item>
      <title>Re: During import CSV, how do I use a host_segment attribute to extract a host name?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378814#M68504</link>
      <description>&lt;P&gt;Ok so it is not possible. &lt;BR /&gt;
Thanks for the information.&lt;/P&gt;</description>
      <pubDate>Wed, 19 Sep 2018 14:02:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/During-import-CSV-how-do-I-use-a-host-segment-attribute-to/m-p/378814#M68504</guid>
      <dc:creator>pmorlon</dc:creator>
      <dc:date>2018-09-19T14:02:38Z</dc:date>
    </item>
  </channel>
</rss>

