Splunk Search

input.conf concat host to host_regex value

stephend
New Member

Hi trying to work out if I can prefix the value returned by host_regex with the actual server name as some of the logs do not identify which server they came from.

I am currently using host_regex to extract the host name from the log path, but that only works for some logs, other have no way to identify the host.

So looking to combine host + host_regex values.

Thanks.

0 Karma

lguinn2
Legend

AFAIK, you can't do that, but here are a few other ideas:

1) On the forwarder, set the host in props.conf for the specific logs with problems.

2) On the indexer, use props.conf plus transforms.conf to set the host to whatever you want...

Here is some documentation from the Getting Data In manual that talks About hosts

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...