Hi @esalmon, if the hostname is in the path of the files to monitor (e.g. /data/host1/logs), you can see in the documentation https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf the host_segment option: host_segment = <integer>
* If set to N, Splunk software sets the Nth "/"-separated segment of the path
as 'host'.
* For example, if host_segment=3, the third segment is used.
* If the value is not an integer or is less than 1, the default 'host'
setting is used.
* On Windows machines, the drive letter and colon before the backslash count
as one segment.
* For example, if you set host_segment=3 and the monitor path is
D:\logs\servers\host01, Splunk software sets the host as "servers" because
that is the third segment.
* No default. If instead the hostname isn't explicitly in the path but it depends on it, you have to create two stanzas with two different host defiitions. Ciao. Giuseppe
... View more
