Getting Data In

apache virtual hosts - custom field?

jgauthier
Contributor

I have several virtual hosts per Apache server, and I want to be able to report on them individually. I envision that I need to add a custom field, somehow, to each input for the indexer?

How could I achieve this? I would prefer all of this happen on the universalforwarder.

Thanks!

Tags (3)
0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

how about adding a field? you can add the following to your search:

| rex field=host /log/var/(?.*)/

you can also add it to your field extractor. Would this work?

jgauthier
Contributor

Oh yeah, that makes a ton of sense! I'll see what I can do with that. Thanks!

0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

how is your log configured right now?

CustomLog ${APACHE_LOG_DIR}/myvirtualhost/access.log

For example, if logs from a virtual host are organized under ${APACHE_LOG_DIR}/myvirtualhost, you can add the following line to your input.conf

[monitor:///var/log/apache/myvirtualhost]
host_segment = 4

That way, "myvirtualhost" will be the host name for all log files that live under myvirtualhost.

Sorry If i misunderstood your question.

0 Karma

jgauthier
Contributor

That could work, but I actually want to retain the host information as the server it comes from. It could be multiple servers.

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...