Splunk Search

input.conf concat host to host_regex value

stephend
New Member

Hi trying to work out if I can prefix the value returned by host_regex with the actual server name as some of the logs do not identify which server they came from.

I am currently using host_regex to extract the host name from the log path, but that only works for some logs, other have no way to identify the host.

So looking to combine host + host_regex values.

Thanks.

0 Karma

lguinn2
Legend

AFAIK, you can't do that, but here are a few other ideas:

1) On the forwarder, set the host in props.conf for the specific logs with problems.

2) On the indexer, use props.conf plus transforms.conf to set the host to whatever you want...

Here is some documentation from the Getting Data In manual that talks About hosts

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...