Getting Data In

host name from log file

indeed_2000
Motivator

hi i have lot's of log file that start with this line for each log
********** LOGFILE FOR SERVER 'host22', AT THE DAY OF : 2020/04/25 **********

now how can i set host name for each log,
expected host name: host22

FYI: all log files copy manually from each server daily, and not use forwarder in this scenario.
all loge copy in /opt like below, and splunk continuously index this path:
log1
log2
log3
...

any recommendation?
Thanks

0 Karma

to4kawa
Ultra Champion

transforms.conf

try INGEST_EVAL or DEST_KEY = MetaData:Host

0 Karma

indeed_2000
Motivator

You mean i should use something like this?

Override host:
[hostoverride]
DEST_KEY = MetaData:Host
REGEX = ^[^'\n]*'(?P\w+)
FORMAT = host::$1

0 Karma

to4kawa
Ultra Champion

yes, Don't forget props.conf.

0 Karma
Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...