Setting Host field value based on a file inside a tar archive

[jstockamp]

I've got access combined logs from a farm of x number of servers tarred up on a daily basis. So the tar file looks like this:

todayslogs.tar
-> appserver1.log
-> appserver2.log
-> appserver3.log

How can I tell splunk to use the host name inside the tar file as the host field? I'd really rather not untar the archive before ingesting it. Surely this has to be possible.

[jstockamp]

Yeah, I know how to set the host name based on a segment of the filename, but in this case the filename is the name of the tar file and the hostname is part of a filename inside the tar file.

[MarioM]

another post which might be useful to you:

Host Based on filename