How to Extract the host values from the path?

[cecilia_cheng1]

Hello everyone,

I am new to splunk. I've got trouble when I was trying to get host values from the path.

The directory I set is D:\14. splunk\SMT\. No matter what kind of extract function i was using: regex or segment, it doesn't work.

For example,

The host name of the following file should be "PCXXXXX", but it still shows the default host name .

However, I already set the host name with regex on path, but it doesn't work...

I also tried Segment in path, it still the same...

Please help...

[gcusello]

Hi @cecilia_cheng1,

you could use the host_segment=3 but anyway, the regex to take the value is

^\w+:(\\[^\\]+){2}\\(?<host>[^\\]+)

that you can test at https://regex101.com/r/hPopwS/1

Ciao.

Giuseppe

[cecilia_cheng1]

Hi @gcusello,

Really appreciated your reply,  I just tried your suggestion, but it still doesn't work... And I've tried the segment 3 before, not working...

😭

BR.

Cecilia

[gcusello]

Hi @cecilia_cheng1,

please try this:

in your inputs.conf stanza

[monitor://D:\*\SMT\*]
host_regex = ^\w+:(\\[^\\]+){2}\\([^\\]+)

Otherwise, you could override the host value on Indexers or Heavy Forwarders in this way:

props.conf

#props.conf
[your_sourcetype]
TRANSFORMS-hostFromSource=hostFromSource

transforms.conf

#transforms.conf
[hostFromSource]
SOURCE_KEY = MetaData:Source
REGEX=^\w+:(\\[^\\]+){2}\\([^\\]+)
FORMAT = $1
DEST_KEY= MetaData:Host

for more infos see at https://docs.splunk.com/Documentation/Splunk/latest/Data/Setadefaulthostforaninput 

Ciao.

Giuseppe

[cecilia_cheng1]

Hi @gcusello ,

Thank you for your supporting.

I moved the data to a new folder and reimported it with "host_segment" stanza and it worked...

The odd thing is, I deleted the original files and paths, but the previous imported files are still visible in the search. Maybe Splunk's data has memory or something, so the previous changes don't take effect and you need to create a new path?

BR.

Cecilia

[gcusello · Accepted solution]

Hi @cecilia_cheng1,

if you already indexed data, they remain in Splunk even if you deleted files!

If you want to delete them from Splunk, you have to use the delete command (with much muche attention!), but anyway, we're speaking of a logical deletion and not of a physical deletion.

If my answer solves your need, please accept it for the other people of Community.

See next time.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[cecilia_cheng1]

Hi @gcusello ,

Yes, that's what I figure out, that the Splunk will "store" the data once indexing them. That's explain everything. 

Thanks again~

BR

Cecilia