Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Extract Hostname using inputs.conf
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have the below event and I'd like to extract the hostname (ccivirpxa0720) using inputs.conf (never have done this before).
####<Oct 4, 2016 10:01:23 AM EDT> <Warning> <ucontrol> <ccivirpxa0720> <managedServer11> <[ACTIVE] ExecuteThread: '11' for queue: 'weblogic.kernel.Default (self-tuning)'> <<anonymous>> <> <> <1475589683462> <BEA-000000> <fn.webapp.listener.AuthenticationListener - Authentication event AuthenticationFailureBadCredentialsEvent: gumbo1379; details: RemoteIpAddress: 10.210.192.15; SessionId: 0j2lXz2Tv11pNLL34bq2vtJN1h3SdvqbVnJpBNr7MDMqnc1TBtSJ!1472708347!1475589683460; exception: Bad credential; nested exception is org.springframework.security.BadCredentialsException: Bad credential>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on your example event, I'm assuming that you're looking to extract the host name from the event data. If that's true, it's done by props/transforms on Indexer/Heavy forwarder and not in inputs.conf on forwarder.
The Splunk documentation has a page with full details, with example, on what needs to be done to achieve that. Have a look at below link.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Overridedefaulthostassignments
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on your example event, I'm assuming that you're looking to extract the host name from the event data. If that's true, it's done by props/transforms on Indexer/Heavy forwarder and not in inputs.conf on forwarder.
The Splunk documentation has a page with full details, with example, on what needs to be done to achieve that. Have a look at below link.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Overridedefaulthostassignments
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Set the event host with the host_segment attribute
The host_segment value overrides the host field with a value that has been extracted from a segment in the path of your data source.
- Edit inputs.conf in $SPLUNK_HOME/etc/system/local/ or in your own custom application directory in $SPLUNK_HOME/etc/apps/.
- Add a host_segment attribute to a stanza to override the host field with a value that has been extracted from a segment in the path of your data source. For example, if the path to the source is /var/log/ and you want the third segment (the host server name) to be the host value, set host_segment as follows:
`[monitor://var/log]
example - host_regex = /var/log/(\w+)
host_regex=\ <\w+\d+>`
-Save the inputs.conf file.
-Restart the Splunk instance.
http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Setadefaulthostforaninput
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
