Specifiy input stanzas by host

[esalmon]

Hi,

I've created an app to be able to monitor some directories for two hosts. The stanzas are completely identical except for the directory path. Is there a way to specify in the inputs.conf which host uses which stanza?

[gcusello]

Hi @esalmon,

if the hostname is in the path of the files to monitor (e.g. /data/host1/logs), you can see in the documentation https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf the host_segment option:

host_segment = <integer>
* If set to N, Splunk software sets the Nth "/"-separated segment of the path
  as 'host'.
    * For example, if host_segment=3, the third segment is used.
* If the value is not an integer or is less than 1, the default 'host'
  setting is used.
* On Windows machines, the drive letter and colon before the backslash count
  as one segment.
    * For example, if you set host_segment=3 and the monitor path is
      D:\logs\servers\host01, Splunk software sets the host as "servers" because
      that is the third segment.
* No default.

If instead the hostname isn't explicitly in the path but it depends on it, you have to create two stanzas with two different host defiitions.

Ciao.

Giuseppe