Specifiy input stanzas by host

esalmon — Tue, 11 Aug 2020 23:54:38 GMT

Hi,

I've created an app to be able to monitor some directories for two hosts. The stanzas are completely identical except for the directory path. Is there a way to specify in the inputs.conf which host uses which stanza?

Re: Specifiy input stanzas by host

gcusello — Wed, 12 Aug 2020 07:50:05 GMT

Hi @esalmon,

if the hostname is in the path of the files to monitor (e.g. /data/host1/logs), you can see in the documentation https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf the host_segment option:

host_segment = <integer> * If set to N, Splunk software sets the Nth "/"-separated segment of the path as 'host'. * For example, if host_segment=3, the third segment is used. * If the value is not an integer or is less than 1, the default 'host' setting is used. * On Windows machines, the drive letter and colon before the backslash count as one segment. * For example, if you set host_segment=3 and the monitor path is D:\logs\servers\host01, Splunk software sets the host as "servers" because that is the third segment. * No default.

If instead the hostname isn't explicitly in the path but it depends on it, you have to create two stanzas with two different host defiitions.

Ciao.

Giuseppe

topic Re: Specifiy input stanzas by host in Getting Data In

Specifiy input stanzas by host

Re: Specifiy input stanzas by host