https://community.splunk.com/t5/Splunk-Search/hostname-regex-path-help/m-p/97560#M25184 <P>This is a good job for <CODE>host_regex</CODE>, which is an option in <CODE>inputs.conf</CODE>. A <CODE>host_regex</CODE> similar to this should work for newly indexed data. (It won't fix previously indexed data is my point)</P> <PRE><CODE>[monitor:///home/user/files] host_regex=^/home/user/files/([^_]+)_\d+\.log$ </CODE></PRE> Tue, 20 Mar 2012 21:31:23 GMT dwaddle 2012-03-20T21:31:23Z https://community.splunk.com/t5/Splunk-Search/hostname-regex-path-help/m-p/97558#M25182 <P>I have files in a directory like this:<BR /> /home/user/files/servername_01020304050607.log <BR /> How can I get the servername only?</P> Tue, 20 Mar 2012 20:45:05 GMT https://community.splunk.com/t5/Splunk-Search/hostname-regex-path-help/m-p/97558#M25182 tiernan 2012-03-20T20:45:05Z https://community.splunk.com/t5/Splunk-Search/hostname-regex-path-help/m-p/97559#M25183 <P>This should do it:</P> <PRE><CODE>^/\w+/\w+/\w+/(?&lt;server&gt;\w+)_ </CODE></PRE> Tue, 20 Mar 2012 21:28:49 GMT https://community.splunk.com/t5/Splunk-Search/hostname-regex-path-help/m-p/97559#M25183 sbrant_tt 2012-03-20T21:28:49Z https://community.splunk.com/t5/Splunk-Search/hostname-regex-path-help/m-p/97560#M25184 <P>This is a good job for <CODE>host_regex</CODE>, which is an option in <CODE>inputs.conf</CODE>. A <CODE>host_regex</CODE> similar to this should work for newly indexed data. (It won't fix previously indexed data is my point)</P> <PRE><CODE>[monitor:///home/user/files] host_regex=^/home/user/files/([^_]+)_\d+\.log$ </CODE></PRE> Tue, 20 Mar 2012 21:31:23 GMT https://community.splunk.com/t5/Splunk-Search/hostname-regex-path-help/m-p/97560#M25184 dwaddle 2012-03-20T21:31:23Z