Splunk Enterprise

Why are there 3 config file slashes?

actionabledata
Engager

All, I am relatively new to Splunk and trying to understand some basics along the way.

https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/Setadefaulthostforaninput

From the Splunk online info, I see the "Example of static host value assignment" ...

This example covers any events coming in from /var/log/httpd

[monitor:///var/log/httpd]
host = webhead-1

Why are there 3 slashes? I understand that the first slash in /var needs to be escaped, but why the 2nd slash?

Sorry for the simple question, but it keeps bugging me.

Labels (1)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
0 Karma

to4kawa
SplunkTrust
SplunkTrust
0 Karma

actionabledata
Engager

My conclusion thus far is that 2 of the slashes are simply the format required for inputs.conf and the 3rd slash is to indicate the path is starting at root for the absolute address path

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!