Getting Data In
Highlighted

inputs.conf segment setting

New Member

Not sure why the hostname for the monitor stanza below is not being parsed out...

directory is as follows:
/mnt/log/files/2017/month/day/HOSTNAME/auth.logs

i would have thought by adding a stanza segment=7 will pull the following hostnames: servera, serverb, serverc... and so forth.

[monitor:///mnt/log/files/2017/03/(05|06|07|08|09)/.../auth.log.gz]
whitelist=servera|serverb|serverc|serverd|servere|serverf
segment=7
index=temp
sourcetype=nix:auth

Not sure what do I have to change here to get this to have the hostname, instead it is pulling the hostname for the local logserver.

0 Karma
Highlighted

Re: inputs.conf segment setting

SplunkTrust
SplunkTrust

Its called host_segment not segment...

from inputs.conf:

host_segment = <integer>
* If set to N, the Nth "/"-separated segment of the path is set as host. If
  host_segment=3, for example, the third segment is used.
* If the value is not an integer or is less than 1, the default "host ="
  setting is used.
* Defaults to unset.
Highlighted

Re: inputs.conf segment setting

SplunkTrust
SplunkTrust

@plumainwfs can you come back to this answer and let us know if it solves your problem by accepting an answer or adding more details?

0 Karma