topic Re: Setting Host field value based on a file inside a tar archive in Splunk Search

Setting Host field value based on a file inside a tar archive

jstockamp — Sat, 07 May 2011 06:42:21 GMT

I've got access combined logs from a farm of x number of servers tarred up on a daily basis. So the tar file looks like this:

todayslogs.tar
-> appserver1.log
-> appserver2.log
-> appserver3.log

How can I tell splunk to use the host name inside the tar file as the host field? I'd really rather not untar the archive before ingesting it. Surely this has to be possible.

Re: Setting Host field value based on a file inside a tar archive

MarioM — Sun, 08 May 2011 09:13:22 GMT

another post which might be useful to you:

Host Based on filename

Re: Setting Host field value based on a file inside a tar archive

jstockamp — Mon, 09 May 2011 15:20:59 GMT

Yeah, I know how to set the host name based on a segment of the filename, but in this case the filename is the name of the tar file and the hostname is part of a filename inside the tar file.