topic Re: Can you help me build a regex that would parse %host% from the following log directories? in Splunk Search

Can you help me build a regex that would parse %host% from the following log directories?

meet_vadaria — Wed, 05 Dec 2018 19:07:51 GMT

I am trying to use host_regex in input.conf
I have log directories as,

/var/log/rsyslog/%year%/%month%/%date%/%host%/syslog

$host$ can be any of following three,
abc-i-1234adfd-foo1 
xx.xx.xx.xx
ip-xx-xx-xx-xx.ec2.internal

thanks,

Re: Can you help me build a regex that would parse %host% from the following log directories?

bjoernjensen — Wed, 05 Dec 2018 20:17:04 GMT

Hey,

I think the easiesst way is if you use host_segment.

For you this would be
host_segment = 7

See: https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

If set to N, Splunk software sets the Nth "/"-separated segment of the path as 'host'.
For example, if host_segment=3, the third segment is used.

Cheerz,
Björn

Re: Can you help me build a regex that would parse %host% from the following log directories?

meet_vadaria — Wed, 05 Dec 2018 20:58:34 GMT

I tried that. it's working only with following 2 %host% values
abc-i-1234adfd-foo1
ip-xx-xx-xx-xx.ec2.internal

it's not able to extract 3rd value which is xx.xx.xx.xx (IP)

Re: Can you help me build a regex that would parse %host% from the following log directories?

meet_vadaria — Wed, 05 Dec 2018 21:01:41 GMT

I tried host_segment = 7. I was actually using that. It was working fine until I had %host% = ip-xx-xx-xx-xx.ec2.internal or abc-i-1234adfd-foo1 .

now, I got this new condition where I am getting ip (XX.XX.XX.XX) in %host%. in this specific case, splunk forwarder is not able to extract IP from that field and it's sending logs with default host (splunk forwarder's hostname) field.

as it's not working, I want to try out host_regex and see if that works.

Re: Can you help me build a regex that would parse %host% from the following log directories?

prakash007 — Tue, 29 Sep 2020 22:21:33 GMT

try any one of this in your inputs.conf for host_regex, it helps if you can post the year/month/data format as well to test the regex...

host_regex = /var/log/rsyslog/\d+/\d+\/\d+/([\w\d\\.-]+)\/syslog
host_regex = \/var\/log\/rsyslog\/\d+\/\d+\/\d+\/([\w\d\\.-]+)\/syslog

lookup this Splunk doc..

http://docs.splunk.com/Documentation/Splunk/7.2.1/Data/Setadefaulthostforaninput#Set_the_event_host_with_the_host_regex_attribute