Archive
Highlighted

Setting Host field value based on a file inside a tar archive

Communicator

I've got access combined logs from a farm of x number of servers tarred up on a daily basis. So the tar file looks like this:

todayslogs.tar
-> appserver1.log
-> appserver2.log
-> appserver3.log

How can I tell splunk to use the host name inside the tar file as the host field? I'd really rather not untar the archive before ingesting it. Surely this has to be possible.

Tags (2)
Highlighted

Re: Setting Host field value based on a file inside a tar archive

Motivator

another post which might be useful to you:

Host Based on filename

0 Karma
Highlighted

Re: Setting Host field value based on a file inside a tar archive

Communicator

Yeah, I know how to set the host name based on a segment of the filename, but in this case the filename is the name of the tar file and the hostname is part of a filename inside the tar file.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.