Getting Data In

How do I fix my host_regex in order to extract the hostname from my log file?

edwardrose
Contributor

Hello all

I am extremely terrible with regex and frankly I am stumped. I am trying to get hostname from the log file that is generated in the path.

/var/log2/collab/bitdefender/ies-av-web-01.log
/var/log2/colab/bitdefender/wv-av-web-01.log

I used the following thinking it would work

[monitor:///var/log2/collab/bitdefender/*.log]
host_regex = [^.log]

But it didn't and the examples from other questions people are specifying the entire path in the host_regex, which from what I read isn't necessary since it should be reading the entire path from the monitor stanza.

thanks in advance

0 Karma
1 Solution

sundareshr
Legend

Try this for your host_regex

host_regex=bitdefender\/(.*)\.log

View solution in original post

sundareshr
Legend

Try this for your host_regex

host_regex=bitdefender\/(.*)\.log
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...