Splunk Dev

get host from fileshare

nurtdi
Path Finder

Hello,
I have multiple inputs.conf entries
...
[monitor://\\server1\share$\mylog.log]
sourcetype = MYLOG
index = mylog
host_segment = 1
...
this creates host = share$ on index server...
changing to host_segment = 0 did not work.
how can I get hostname out of fileshare (\\server\share$\log)?

please help.

thank you.

Tags (1)
1 Solution

nurtdi
Path Finder

Thank you for your answer. Although it did not work...
The solution was quite simple - I just needed to use static host = server1 in each stanza.
Thanks.

View solution in original post

0 Karma

nurtdi
Path Finder

Thank you for your answer. Although it did not work...
The solution was quite simple - I just needed to use static host = server1 in each stanza.
Thanks.

0 Karma

Takajian
Builder

Could you try host_regex like as bellow? It will work for your requirement.

[monitor://xxxxxxxxxxx]
host_regex = (server\d+)

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...