Getting Data In

How to add constant to HOST name using regular expression

neilli
Engager

I am using a reg-exp to set the host name from the file path
e.g. \servername\logs\application\ag_clientname_log
monitor \servername\logs\application\ag_*
host_regex = (ag_[^_]+)
this gives me "ag_clientname" but I want "clientname_ag_logs" to match what we had previously been collecting.

0 Karma

woodcock
Esteemed Legend

There is no way to do this that I know. I would create a link to each file in a different directory and give each the link the correct name and point the monitor to the other directory. This consumes NO extra disk space (only 1 inode per file).

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
You could use also eval
| eval host=substr(host,4,15)+"_ag_logs"

Bye
Giuseppe

Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...