Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Specifiy input stanzas by host

esalmon
Explorer

Hi,

I've created an app to be able to monitor some directories for two hosts. The stanzas are completely identical except for the directory path. Is there a way to specify in the inputs.conf which host uses which stanza?

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @esalmon,

if the hostname is in the path of the files to monitor (e.g. /data/host1/logs), you can see in the documentation https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf the host_segment option:

host_segment = <integer>
* If set to N, Splunk software sets the Nth "/"-separated segment of the path
  as 'host'.
    * For example, if host_segment=3, the third segment is used.
* If the value is not an integer or is less than 1, the default 'host'
  setting is used.
* On Windows machines, the drive letter and colon before the backslash count
  as one segment.
    * For example, if you set host_segment=3 and the monitor path is
      D:\logs\servers\host01, Splunk software sets the host as "servers" because
      that is the third segment.
* No default.

If instead the hostname isn't explicitly in the path but it depends on it, you have to create two stanzas with two different host defiitions.

Ciao.

Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!