topic host_regex is not working extract host name from windows path in Splunk Search

host_regex is not working extract host name from windows path

splunked38 — Fri, 13 Sep 2013 09:57:47 GMT

All,

I'm trying to use host_regex to extract host names for input

Background:

All logs are copied to a windows fileshare (installing agents on the servers are out of scope
it would make life easier) logs are in different folder (split due as they all have different timezones - servers cannot use UTC/GMT)
logs are in the following locations and format:
C:\foo\bar\Splunk\EET\fihel01srv001-Mon.log
C:\foo\bar\Splunk\CET\frpar01srv001-Mon.log
C:\foo\bar\Splunk\WET\uklon01srv001-Mon.log
etc...

Aim

to get:

fihel01srv001

frpar01srv001

uklon01srv001

Attempted:

the following (unoptimised) search works :
index=test | rex field=source ".*?(?[a-z]+[0-9]+[a-z]+[0-9]+)-.+\.log$"

but...

when putting this into inputs.conf, it doesn't work

host field is set to the server that is indexing the logs

ie: host=splunkserver

inputs.conf:
[monitor://C:\foo\bar\Splunk\WET\.log]
disabled = false
followTail = 0
index = test
sourcetype = testlogs
crcSalt=
host_regex = ".?([a-z]+[0-9]+[a-z]+[0-9]+)-.+\.log$"

BTW: also open to other alternative solutions...

Re: host_regex is not working extract host name from windows path

antlefebvre — Mon, 28 Sep 2020 14:46:26 GMT

Per

Splunk inputs.conf doc

the host_regex extracts from the path, not the filename.

Alternate solution. Put each server log in it's own folder and use host_regex or easier use host_segment.

Re: host_regex is not working extract host name from windows path

lukejadamec — Fri, 13 Sep 2013 13:41:22 GMT

I'm not sure how many slashes, but this might work for your host_regex in inputs.conf

\\\\\([a-z]+[0-9]+[a-z]+[0-9]+)-.+.log$"

Re: host_regex is not working extract host name from windows path

splunked38 — Mon, 16 Sep 2013 09:08:45 GMT

Actually, the path includes the file name, you can test this by using the following regex: (.+)

Re: host_regex is not working extract host name from windows path

splunked38 — Mon, 16 Sep 2013 09:09:27 GMT

Sorry, this doesn't work, even without the quotes. Using the regex (.+), the path is prefixed with 'source:' therefore the regex will fail. The solution below.

Re: host_regex is not working extract host name from windows path

splunked38 — Mon, 16 Sep 2013 09:10:23 GMT

ok, the answer is...remove the quotes!

The following works:

 host_regex =_*?([a-z]+[0-9]+[a-z]+[0-9]+)-.+\\.log$