My previous team has set a static host name in the input.conf. I am currently trying to make the IP as the host name. I had tried using host_segment=3 and it did not work. Any suggestions?
[default]
host = IDSPGASPVLOGP01
[monitor:///opt/syslog/172.16.43.126/*/*/*]
disabled = 0
sourcetype = cisco:ios
interval = 30
[monitor:///opt/syslog/172.16.63.77/*/*/*]
disabled = 0
sourcetype = cisco:ios
interval = 30
[monitor:///opt/syslog/172.16.43.30/*/*/*]
disabled = 0
sourcetype = cisco:ios
interval = 30
Hi
When your files are named e.g. /opt/syslog/172.16.43.126/net/Cisco/router.log then your monitor should match these and also that host_segment = 3 should work.
What btool shows for inputs?
Can you try the next (just replace those multiple with this)
[monitor:///opt/syslog/172.*/*/*/*]
host_segment = 3
disabled = 0
sourcetype = cisco:ios
interval = 30
r. Ismo
How about INGEST_EVAL with extracting from source?