Hi I have log files like this:
these files copy each day to /opt , and splunk continuously monitor /opt.
now how can I use log filename to set "host" "date" of logs in splunk?
FYI: in every line of log file only store time NOT date! that's why I need to use date that exist in file name.
file name = log.machine05.20200310.bz2
01:00:00 info logmessage
02:00:00 info logmessage
03:00:00 info logmessage
You can set host from file name in inputs.conf on forwarder.
[monitor://<path>] sourcetype = sourcetype_name host_regex = [a-zA-Z]+\d+(?!$)
For setting _time from file name use INGET-EVAL. Add below configurations on indexer server.
[sourcetype_name] TRANSFORMS = timestamp_eval
[timestamp_eval] INGEST_EVAL = _time=strptime(replace(source, "/opt/log\.[\w]+\.", ""), "%Y%m%d.bz2")
Note: INGEST_EVAL is supported in splunk version >= 7.2.0.