Getting Data In

How do I fix my host_regex in order to extract the hostname from my log file?

edwardrose
Contributor

Hello all

I am extremely terrible with regex and frankly I am stumped. I am trying to get hostname from the log file that is generated in the path.

/var/log2/collab/bitdefender/ies-av-web-01.log
/var/log2/colab/bitdefender/wv-av-web-01.log

I used the following thinking it would work

[monitor:///var/log2/collab/bitdefender/*.log]
host_regex = [^.log]

But it didn't and the examples from other questions people are specifying the entire path in the host_regex, which from what I read isn't necessary since it should be reading the entire path from the monitor stanza.

thanks in advance

0 Karma
1 Solution

sundareshr
Legend

Try this for your host_regex

host_regex=bitdefender\/(.*)\.log

View solution in original post

sundareshr
Legend

Try this for your host_regex

host_regex=bitdefender\/(.*)\.log
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...