Can I Assign to Host The Value From A Variable?

[attoriozi]

I would like to assign to "host" a variable initiated in the input script.

For instance, is it possible something like this:

[script://./bin/hostrandom.sh]

interval = 10

host = $RHOST

sourcetype = hostrandom

disabled = 0

where

cat ../bin/hostrandom.sh

export RHOST=HOST$RANDOM

echo "This is the Event for $RHOST "

[gkanapathy]

You can't do this based on a value that is set in the scripted input, though you can use a variable that is set in the environment in which the Splunk process runs. However, if you have a scripted input, there are other ways to set the host by having the script itself output a field that can be transformed at index time, or by using dynamic metadata assignment

[gkanapathy]

Don't use should_linemerge = true. Use SHOULD_LINEMERGE = false and a unique LINE_BREAKER pattern between events.

[attoriozi]

still not good: in my case the input script generates an event that needs to be split in multiple events (SHOULD_LINEMERGE=true). In this case only one of those events is going to be associated to the extracted host, all the other are going to be associated to default host.

[attoriozi]

basically doing the above and then use a index time extraction. Ok thanks

[attoriozi]

Documentation is not very clear. I think it just suggests a script like: << echo "This is the Event for host=RHOST$RANDOM " >>