Splunk Search

How to perform search among multiple instances based on instance name?

New Member

I run multiple instances of the same application on a server. Each instance generates its own set of log files, and I want to be able to perform searches based on the instance.

The log files are all located by the following path:


I need a way to perform searches based on the instance name . The instance name is NOT contained in the log data, only in the file path.

If I wanted to usurp the "host" field, I could use the features of inputs.conf that allow me to extract the host from the file path. I am not sure this is a good solution for me, because I have multiple hosts doing this multiple instance thing and I would rather know the real host as well as the instance.

Any suggestions?

0 Karma


The file name should show up in the source field, so you might try something like this:

your-search-goes-here | rex field=source "/var/log/myapp/instances/(?<instance-name>\w+)/(.*)"

This should pull out your instance name into a field called instance-name that you can then work with.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...