Getting Data In

apache virtual hosts - custom field?

jgauthier
Contributor

I have several virtual hosts per Apache server, and I want to be able to report on them individually. I envision that I need to add a custom field, somehow, to each input for the indexer?

How could I achieve this? I would prefer all of this happen on the universalforwarder.

Thanks!

Tags (3)
0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

how about adding a field? you can add the following to your search:

| rex field=host /log/var/(?.*)/

you can also add it to your field extractor. Would this work?

jgauthier
Contributor

Oh yeah, that makes a ton of sense! I'll see what I can do with that. Thanks!

0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

how is your log configured right now?

CustomLog ${APACHE_LOG_DIR}/myvirtualhost/access.log

For example, if logs from a virtual host are organized under ${APACHE_LOG_DIR}/myvirtualhost, you can add the following line to your input.conf

[monitor:///var/log/apache/myvirtualhost]
host_segment = 4

That way, "myvirtualhost" will be the host name for all log files that live under myvirtualhost.

Sorry If i misunderstood your question.

0 Karma

jgauthier
Contributor

That could work, but I actually want to retain the host information as the server it comes from. It could be multiple servers.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...