Hi,
I'm currently evaluating Splunk (just trying out the free version), and have a question regarding the way Splunk determines the host a given event belongs to, and the event's type.
The way the logging system (I was assigned to) is currently implemented is that logs get compressed on the clients and then SSH'd to the log server. There is audit log software that handles all of it, but I'm looking to possibly replacing it. Anyway, I tried pointing Splunk to the compressed files and it indeed looks inside and indexes it (I was impressed). However, it seems to be a bit off when it comes to figuring out the logtype and hostname for the events. Both of these pieces of information are contained in the compressed file's filename where the logs are actually located. Is there a way to tell Splunk to use those values for any and all events it finds in a particular (compressed) log file?
The file names have the format: ...gz
Thanks!
Pedro
