Implementing Splunk 7, Third Edition - Third Edition

Setting the value of the host from the source

The default behavior of using the hostname from the machine forwarding the logs is almost always what you want. If, however, you are reading logs for a number of hosts, you can extract the hostname from the source using host_regex or host_segment. For instance, say we have the path:

/nfs/logs/webserver1/access.log 

To set host to webserver1, you could use:

[monitor:///nfs/logs/*/access.log*] 
sourcetype=access 
host_segment=3 

You could also use:

[monitor:///nfs/logs/*/access.log*] 
sourcetype=access 
host_regex=/(.*?)/access.log 

The host_regex variable could also be used to extract the value of the host from the filename. It is also possible to reset the host using a transform, with the caveat that ...