Getting Data In

Set regex hostname from file location

dersa
Path Finder

Hi, I am having troubles with providing the correct regex to extract the hostname from the file location. The file structure looks like this 

/var/log/syslog/splunk-lb/ise/switch01.log

I need only the switch01 as hostname but splunk add switch01.log.

The regex i use is (?:[\/][^\/]*){1,}[\/](\w*)

Any idea how to modify the regex to match only switch01?

thanks

Alex

 

Labels (1)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Your regex seems pretty OK. You could try to simplify it a bit (the character class is not needed if you want just one character, slashes don't need escaping and {1,} can be replaced by +)  so you could do something like this:

(?:/[^/]*)+/(\w*)

But you can simplify it even further

(?:.*)/(\w*)

You could take one thing into account though - a valid hostname can contain a dash which is not included in \w. Also, depending on your environment, if it's a FQDN, it can contain dots.

 

dersa
Path Finder

Cheers Rick, 

The regex I ended up is like this (?:.*)\/(\w*). The one you suggested,(?:.*)/(\w*), didn't work.  

thanks Alex

0 Karma

PickleRick
SplunkTrust
SplunkTrust

That is puzzling. If I understand correctly, you're talking about the host_regex setting of the monitor input, right?

The docs don't say that there is any kind of escaping required. If it is however, it would be great if you posted a docs feedback (there is a form at the bottom of https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ) describing your situation and how it differs from the described state.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...