Getting Data In

transform hostname based on log filename?

stwong
Communicator

Hi, we're going to monitor following files on a host with universal forwarder installed:

/data/asav/gw1new/log1.gz
/data/asav/gw2new/log1.gz
/data/asav/gw3new/log1.gz

Since there is no hostname recorded in the log, we want to set hostname like this for stanza [monitor:///data/asav/gw*/*gz]:

gw1new -> mailgw1
gw2new -> mailgw2
gw3new -> mailgw3

Would anyone please help?
Thanks a lot.

/ST Wong

0 Karma
1 Solution

mirkoneverstops
Path Finder

Check this inputs.conf setting:
host_segment = *integer*
Sets the segment of the path as the host, using integer to determine the segment.
For example, if host_segment = 2, host becomes the second segment of the path. Path segments are separated by the '/' character.

Source: http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Monitorfilesanddirectorieswithinputs.conf

View solution in original post

0 Karma

mirkoneverstops
Path Finder

Check this inputs.conf setting:
host_segment = *integer*
Sets the segment of the path as the host, using integer to determine the segment.
For example, if host_segment = 2, host becomes the second segment of the path. Path segments are separated by the '/' character.

Source: http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Monitorfilesanddirectorieswithinputs.conf

0 Karma

stwong
Communicator

Thanks, but we hope to do some transform based on segment 3, e.g.

/data/asav/gw1new/log.1.gz

host_rex = 3 gives gw1new. Then we hope to do something like:

echo gw1new | sed 's/(gw[0-9])new$/mail\1/g'

that gives mailgw1.

Possible to do so?
Thanks.

0 Karma

mirkoneverstops
Path Finder

Yes, with a transform like:

[rename_gw_hostname]
SOURCE_KEY = MetaData:Host
REGEX = host::(\w\w\d)new
FORMAT = host::mail$1
DEST_KEY = MetaData:Host

Applied with props like:
[host::gw*new]
TRANSFORMS-rename_gw_hostname = rename_gw_hostname

I didn't tested it but it should work.

0 Karma

stwong
Communicator

It works! Thanks a lot for your help.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...