I've got access combined logs from a farm of x number of servers tarred up on a daily basis. So the tar file looks like this:
How can I tell splunk to use the host name inside the tar file as the host field? I'd really rather not untar the archive before ingesting it. Surely this has to be possible.
another post which might be useful to you:
Host Based on filename
Yeah, I know how to set the host name based on a segment of the filename, but in this case the filename is the name of the tar file and the hostname is part of a filename inside the tar file.