Getting Data In

apache virtual hosts - custom field?

jgauthier
Contributor

I have several virtual hosts per Apache server, and I want to be able to report on them individually. I envision that I need to add a custom field, somehow, to each input for the indexer?

How could I achieve this? I would prefer all of this happen on the universalforwarder.

Thanks!

Tags (3)
0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

how about adding a field? you can add the following to your search:

| rex field=host /log/var/(?.*)/

you can also add it to your field extractor. Would this work?

jgauthier
Contributor

Oh yeah, that makes a ton of sense! I'll see what I can do with that. Thanks!

0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

how is your log configured right now?

CustomLog ${APACHE_LOG_DIR}/myvirtualhost/access.log

For example, if logs from a virtual host are organized under ${APACHE_LOG_DIR}/myvirtualhost, you can add the following line to your input.conf

[monitor:///var/log/apache/myvirtualhost]
host_segment = 4

That way, "myvirtualhost" will be the host name for all log files that live under myvirtualhost.

Sorry If i misunderstood your question.

0 Karma

jgauthier
Contributor

That could work, but I actually want to retain the host information as the server it comes from. It could be multiple servers.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...