https://community.splunk.com/t5/Getting-Data-In/Need-help-extracting-a-hostname-from-a-source-path/m-p/42073#M7822 <P>An even easier approach might be <CODE>host_segment</CODE> in <CODE>inputs.conf</CODE>. Using your example,</P> <PRE><CODE>[monitor:///var/log/fms] host_segment=4 sourcetype=fms_source_type </CODE></PRE> Thu, 03 May 2012 00:19:20 GMT dwaddle 2012-05-03T00:19:20Z https://community.splunk.com/t5/Getting-Data-In/Need-help-extracting-a-hostname-from-a-source-path/m-p/42072#M7821 <P>Hey guys, </P> <P>I'm a noob at props and transforms. </P> <P>Trying to basically extract a hostname from a sourcepath. </P> <P>Example: </P> <PRE><CODE>/var/log/fms/host/blah/ </CODE></PRE> <P>I would like to extract "host" and use that as the hostname for the source log. </P> <P>Here is how I am doing it so far: </P> <PRE><CODE>[host-extract] SOURCE_KEY = MetaData:Source REGEX = (\/var\/log\/fms\/)([0-9a-zA-Z\.\-_/]+)?\/ DEST_KEY = MetaData:Host FORMAT = $2 </CODE></PRE> <P>I also setup the following in props for this transform: </P> <PRE><CODE>[FMS_LF] TRANSFORMS-host = host-extract </CODE></PRE> <P>However seems like its not working...</P> <P>Any thoughts? Is my regex not right?</P> <P>Any help you can provide would be great. </P> <P>Thanks. </P> <P>Brian</P> Thu, 03 May 2012 00:04:26 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-extracting-a-hostname-from-a-source-path/m-p/42072#M7821 balbano 2012-05-03T00:04:26Z https://community.splunk.com/t5/Getting-Data-In/Need-help-extracting-a-hostname-from-a-source-path/m-p/42073#M7822 <P>An even easier approach might be <CODE>host_segment</CODE> in <CODE>inputs.conf</CODE>. Using your example,</P> <PRE><CODE>[monitor:///var/log/fms] host_segment=4 sourcetype=fms_source_type </CODE></PRE> Thu, 03 May 2012 00:19:20 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-extracting-a-hostname-from-a-source-path/m-p/42073#M7822 dwaddle 2012-05-03T00:19:20Z