host_regex is not working extract host name from windows path

[splunked38]

All,

I'm trying to use host_regex to extract host names for input

Background:

• All logs are copied to a windows fileshare (installing agents on the servers are out of scope
• it would make life easier) logs are in different folder (split due as they all have different timezones - servers cannot use UTC/GMT)
• logs are in the following locations and format:
  C:\foo\bar\Splunk\EET\fihel01srv001-Mon.log
  C:\foo\bar\Splunk\CET\frpar01srv001-Mon.log
  C:\foo\bar\Splunk\WET\uklon01srv001-Mon.log
  etc...

Aim

to get:

fihel01srv001

frpar01srv001

uklon01srv001

Attempted:

• the following (unoptimised) search works :
  index=test | rex field=source ".*?(?[a-z]+[0-9]+[a-z]+[0-9]+)-.+\.log$"
  

but...

when putting this into inputs.conf, it doesn't work

host field is set to the server that is indexing the logs

ie: host=splunkserver

inputs.conf:
[monitor://C:\foo\bar\Splunk\WET\.log]
disabled = false
followTail = 0
index = test
sourcetype = testlogs
crcSalt=
host_regex = ".?([a-z]+[0-9]+[a-z]+[0-9]+)-.+\.log$"

BTW: also open to other alternative solutions...

[splunked38 · Accepted solution]

ok, the answer is...remove the quotes!

The following works:

 host_regex =_*?([a-z]+[0-9]+[a-z]+[0-9]+)-.+\\.log$

[lukejadamec]

I'm not sure how many slashes, but this might work for your host_regex in inputs.conf

\\\\\([a-z]+[0-9]+[a-z]+[0-9]+)-.+.log$"

[splunked38]

Sorry, this doesn't work, even without the quotes. Using the regex (.+), the path is prefixed with 'source:' therefore the regex will fail. The solution below.

[antlefebvre]

Per

Splunk inputs.conf doc

the host_regex extracts from the path, not the filename.

Alternate solution. Put each server log in it's own folder and use host_regex or easier use host_segment.

[splunked38]

Actually, the path includes the file name, you can test this by using the following regex: (.+)