Splunk Search

Setting Host field value based on a file inside a tar archive

jstockamp
Communicator

I've got access combined logs from a farm of x number of servers tarred up on a daily basis. So the tar file looks like this:

todayslogs.tar
-> appserver1.log
-> appserver2.log
-> appserver3.log

How can I tell splunk to use the host name inside the tar file as the host field? I'd really rather not untar the archive before ingesting it. Surely this has to be possible.

Tags (2)

jstockamp
Communicator

Yeah, I know how to set the host name based on a segment of the filename, but in this case the filename is the name of the tar file and the hostname is part of a filename inside the tar file.

0 Karma

MarioM
Motivator

another post which might be useful to you:

Host Based on filename

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...