I think the easiesst way is if you use
For you this would be
host_segment = 7
If set to N, Splunk software sets the Nth "/"-separated segment of the path as 'host'.
For example, if host_segment=3, the third segment is used.
I tried that. it's working only with following 2 %host% values
it's not able to extract 3rd value which is xx.xx.xx.xx (IP)
I tried host_segment = 7. I was actually using that. It was working fine until I had %host% = ip-xx-xx-xx-xx.ec2.internal or abc-i-1234adfd-foo1 .
now, I got this new condition where I am getting ip (XX.XX.XX.XX) in %host%. in this specific case, splunk forwarder is not able to extract IP from that field and it's sending logs with default host (splunk forwarder's hostname) field.
as it's not working, I want to try out host_regex and see if that works.
try any one of this in your inputs.conf for host_regex, it helps if you can post the year/month/data format as well to test the regex...
host_regex = /var/log/rsyslog/\d+/\d+\/\d+/([\w\d\\.-]+)\/syslog host_regex = \/var\/log\/rsyslog\/\d+\/\d+\/\d+\/([\w\d\\.-]+)\/syslog
lookup this Splunk doc..