Splunk Search

Can you help me build a regex that would parse %host% from the following log directories?

meet_vadaria
Engager

I am trying to use host_regex in input.conf
I have log directories as,

/var/log/rsyslog/%year%/%month%/%date%/%host%/syslog

$host$ can be any of following three,
abc-i-1234adfd-foo1 
xx.xx.xx.xx
ip-xx-xx-xx-xx.ec2.internal

thanks,

0 Karma

bjoernjensen
Contributor

Hey,

I think the easiesst way is if you use host_segment.

For you this would be
host_segment = 7

See: https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

If set to N, Splunk software sets the Nth "/"-separated segment of the path as 'host'.
For example, if host_segment=3, the third segment is used.

Cheerz,
Björn

meet_vadaria
Engager

I tried host_segment = 7. I was actually using that. It was working fine until I had %host% = ip-xx-xx-xx-xx.ec2.internal or abc-i-1234adfd-foo1 .

now, I got this new condition where I am getting ip (XX.XX.XX.XX) in %host%. in this specific case, splunk forwarder is not able to extract IP from that field and it's sending logs with default host (splunk forwarder's hostname) field.

as it's not working, I want to try out host_regex and see if that works.

0 Karma

prakash007
Builder

try any one of this in your inputs.conf for host_regex, it helps if you can post the year/month/data format as well to test the regex...

host_regex = /var/log/rsyslog/\d+/\d+\/\d+/([\w\d\\.-]+)\/syslog
host_regex = \/var\/log\/rsyslog\/\d+\/\d+\/\d+\/([\w\d\\.-]+)\/syslog

lookup this Splunk doc..

http://docs.splunk.com/Documentation/Splunk/7.2.1/Data/Setadefaulthostforaninput#Set_the_event_host_...

0 Karma

meet_vadaria
Engager

I tried that. it's working only with following 2 %host% values
abc-i-1234adfd-foo1
ip-xx-xx-xx-xx.ec2.internal

it's not able to extract 3rd value which is xx.xx.xx.xx (IP)

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...