Getting Data In

Trouble with Host Extraction at Index Time

JPrictoe
Loves-to-Learn

To me this should be simple, but I can't get it. When entering host info while adding data I select "regex on path" and enter the regex for my capture group, but it still returns my default host upon search for that particular source. Even if I change my default host name in system/local or search/local inputs.conf, I still get my default host. Also if I select "segment on path" and just try to name it something along the path, I still get my default host. Even if my regex was not sound, some of these other options should work, where is Splunk continually pulling my default host from if I take it out of .conf files entirely?

0 Karma

tiagofbmm
Influencer

To check where splunk is using your default host, use btool

$SPLUNK_HOME/bin/splunk btool inputs list --debug

It will show you the running configuration in your inputs and show you for the stanza you'rel looking for, where is it getting the default host from (where meaning from which conf file specifically)

0 Karma

tiagofbmm
Influencer

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...