Getting Data In

Host name can not be change

msona
Explorer

Hi all,

I am new to splunk, I want a directory name as Host name my directory structure is as follows:

C:/Program Files/Splunk/etc/apps/ntt_tougou/tougou_logs/AB/abcd/log1.csv
C:/Program Files/Splunk/etc/apps/ntt_tougou/tougou_logs/FS/kfcd/log1.csv
C:/Program Files/Splunk/etc/apps/ntt_tougou/tougou_logs/AVD/gbd/log1.csv

I want different host name like directory names AB FS AVD

input.conf:
[monitor:C:/Program Files/Splunk/etc/apps/ntt_tougou/tougou_logs/]
host_segment =7

By above configuration I am getting host name as default name of my computer. Is my settings are correct ? Where I am wrong ?

Your help will be appreciated.

Tags (1)
0 Karma
1 Solution

rotten
Communicator

The only time we've used host_segment, the segment name is in the monitor stanza (rather than after it somewhere), and it has worked well for us.

ie:

Instead of -

C:/Program Files/Splunk/etc/apps/ntt_tougou/tougou_logs

Try something like -

C:/Program Files/Splunk/etc/apps/ntt_tougou/tougou_logs/.../.../*

I have no idea if that will help, but it is worth a try until someone with a more definitive answer can chime in...

View solution in original post

0 Karma

msona
Explorer

it is inputs.conf sorry for spell mistake.

0 Karma

rotten
Communicator

The only time we've used host_segment, the segment name is in the monitor stanza (rather than after it somewhere), and it has worked well for us.

ie:

Instead of -

C:/Program Files/Splunk/etc/apps/ntt_tougou/tougou_logs

Try something like -

C:/Program Files/Splunk/etc/apps/ntt_tougou/tougou_logs/.../.../*

I have no idea if that will help, but it is worth a try until someone with a more definitive answer can chime in...

0 Karma

msona
Explorer

Thank you very much for the help....
Its working..!!!!

0 Karma

Rob
Splunk Employee
Splunk Employee

Is your file named 'input.conf' or 'inputs.conf'?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...