I have two different types of logs, performance logs and alert logs. for performance logs , I have a folder structure as follows, \Splunk\etc\apps\myApp\logs\log_sample\host1\gn1*.cvs \Splunk\etc\apps\myApp\logs\log_sample\host2\gn2*.cvs \Splunk\etc\apps\myApp\logs\log_sample\host3\gn3*.cvs
here, host1, host2, and host3 are my host names. I managed to extract above host names using "host_segment" in inputs.conf.
Now, for alert logs I have a below directory structure. \Splunk\etc\apps\myApp\logs\AlertLogs*.csv For all these alert logs I need a static hostname say "alert".
How can I configure Inputs.conf to handle above situation ?