Splunk Dev

get host from fileshare

nurtdi
Path Finder

Hello,
I have multiple inputs.conf entries
...
[monitor://\\server1\share$\mylog.log]
sourcetype = MYLOG
index = mylog
host_segment = 1
...
this creates host = share$ on index server...
changing to host_segment = 0 did not work.
how can I get hostname out of fileshare (\\server\share$\log)?

please help.

thank you.

Tags (1)
1 Solution

nurtdi
Path Finder

Thank you for your answer. Although it did not work...
The solution was quite simple - I just needed to use static host = server1 in each stanza.
Thanks.

View solution in original post

0 Karma

nurtdi
Path Finder

Thank you for your answer. Although it did not work...
The solution was quite simple - I just needed to use static host = server1 in each stanza.
Thanks.

0 Karma

Takajian
Builder

Could you try host_regex like as bellow? It will work for your requirement.

[monitor://xxxxxxxxxxx]
host_regex = (server\d+)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...