Getting Data In
Highlighted

Host based on filename

New Member

How can you create a "host" by the file name being indexed? Im looking to index my firewall configuration files, and currently the snapshots are saved with the firewalls hostname. Clear as mud?

0 Karma
Highlighted

Re: Host based on filename

Legend

You can look at the host_segment and host_regex settings that can be used with the file monitor stanzas in inputs.conf, to extract the source host from the file path.

View solution in original post

Highlighted

Re: Host based on filename

New Member

Your the man!!!

0 Karma
Highlighted

Re: Host based on filename

Builder

FYI, and as a supplemental to the above answer, I keep my files in the following directory:

/var/splunk/input/mms_logs/

The filename structure is:

mms_HOST-IP-ADDRESS_TIMESTAMP.log

examples:

mms_10.152.58.100_20110101_004000_06137.log
mms_10.152.58.194_20110121_120000_70656.log

Now to extract the IP address portion of filename as a host, I used the following regex:

/var/splunk/input/mms_logs/mms_(\d+.\d+.\d+.\d+)_\d+

Voila! From the above examples I know have two hosts (10.152.58.100 & 10.152.58.194), along with all of the events that are hosted within the files 🙂

Hope this helps someone!

0 Karma