topic Re: dynamic host name in Getting Data In

dynamic host name

eidil — Tue, 18 Aug 2020 07:19:46 GMT

My previous team has set a static host name in the input.conf. I am currently trying to make the IP as the host name. I had tried using host_segment=3 and it did not work. Any suggestions?

[default]
host = IDSPGASPVLOGP01

[monitor:///opt/syslog/172.16.43.126/*/*/*]
disabled = 0
sourcetype = cisco:ios
interval = 30

[monitor:///opt/syslog/172.16.63.77/*/*/*]
disabled = 0
sourcetype = cisco:ios
interval = 30

[monitor:///opt/syslog/172.16.43.30/*/*/*]
disabled = 0
sourcetype = cisco:ios
interval = 30

Re: dynamic host name

to4kawa — Tue, 18 Aug 2020 07:33:39 GMT

How about INGEST_EVAL with extracting from source?

Re: dynamic host name

isoutamo — Tue, 18 Aug 2020 15:45:09 GMT

When your files are named e.g. /opt/syslog/172.16.43.126/net/Cisco/router.log then your monitor should match these and also that host_segment = 3 should work.

What btool shows for inputs?

Can you try the next (just replace those multiple with this)

[monitor:///opt/syslog/172.*/*/*/*] host_segment = 3 disabled = 0 sourcetype = cisco:ios interval = 30

r. Ismo