Extracting multi-level host name

[smhsplunk]

I would like to extract both directory and subdirectory information while importing data.

So basically the directory structure is like this

monitor:///data/host_name_first_part/host_name_second_part/*.gz

So in the input.conf I can use either host_segment=2 or host_segment=3
but cannot extract both the information, how can I extract both these information.

I am using unique index name for the data, sourcetype is defined in props.conf
how can extract the host names (separately) so that I can also use them in the search command
(i.e. I can use host_segment as host in the search command)

[gcusello]

You could use a rex command like this

rex field=source "data\/(?<Field1>\w+)\/(?<Field2>\w+)\/"

Bye.
Giuseppe

[somesoni2]

You can setup search time field extraction (on your Search Head) to have both the segments extracted in separate fields. Once you've the field extraction setup, you can use them i the search.

See these for more info on field extraction

http://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Createandmaintainsearch-timefieldextract...
https://answers.splunk.com/answers/107529/best-way-to-create-a-search-time-field-extraction.html

Not sure if this is something which will work for you, but you can use host_regex in inputs.conf, instead of host_segment, to set the host with both the segment values.