topic Re: host name from log file in Getting Data In

host name from log file

indeed_2000 — Sun, 26 Apr 2020 17:32:38 GMT

hi i have lot's of log file that start with this line for each log
********** LOGFILE FOR SERVER 'host22', AT THE DAY OF : 2020/04/25 **********

now how can i set host name for each log,
expected host name: host22

FYI: all log files copy manually from each server daily, and not use forwarder in this scenario.
all loge copy in /opt like below, and splunk continuously index this path:
log1
log2
log3
...

any recommendation?
Thanks

Re: host name from log file

to4kawa — Sun, 26 Apr 2020 19:45:54 GMT

transforms.conf

try INGEST_EVAL or DEST_KEY = MetaData:Host

Re: host name from log file

indeed_2000 — Sun, 26 Apr 2020 22:33:38 GMT

You mean i should use something like this?

Override host:
[hostoverride]
DEST_KEY = MetaData:Host
REGEX = ^[^'\n]*'(?P\w+)
FORMAT = host::$1

Re: host name from log file

to4kawa — Mon, 27 Apr 2020 09:03:43 GMT

yes, Don't forget props.conf.