Getting Data In

How do I fix my host_regex in order to extract the hostname from my log file?

edwardrose
Contributor

Hello all

I am extremely terrible with regex and frankly I am stumped. I am trying to get hostname from the log file that is generated in the path.

/var/log2/collab/bitdefender/ies-av-web-01.log
/var/log2/colab/bitdefender/wv-av-web-01.log

I used the following thinking it would work

[monitor:///var/log2/collab/bitdefender/*.log]
host_regex = [^.log]

But it didn't and the examples from other questions people are specifying the entire path in the host_regex, which from what I read isn't necessary since it should be reading the entire path from the monitor stanza.

thanks in advance

0 Karma
1 Solution

sundareshr
Legend

Try this for your host_regex

host_regex=bitdefender\/(.*)\.log

View solution in original post

sundareshr
Legend

Try this for your host_regex

host_regex=bitdefender\/(.*)\.log
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...