Getting Data In

Search by host (all indexed data Hosts list)

mudricd
Explorer

Hi,

I have syslog_ng server (sles 10). Everything is logged in this way:

/var/log/HOSTS/xx-yy/hostname or ip/log file

I have 10 syslog clients and everything works fine. Folder for every host is created...

Then i installed splunk and cofigured data inputs /var/log/HOSTS

When i go to splunk>search in all indexed data under sources i have all my log files but in Hosts section i have only one host, my sles syslog server where all messages are stored together.

I would like to have all my syslog clients under Hosts section to browse messages separately by client (host). Is it possible?

Thanks in advanced

Dragan

Tags (1)
0 Karma

the_wolverine
Champion

Hi Dragan,

If you configure for this input, set host = segment in path, it should automatically figure out your syslog hosts. Since the input has already been created you won't be able to edit it from the UI. However, you can modify the monitor input directly in $SPLUNK_HOME/etc/.../local/inputs.conf:

[monitor:///var/log/HOSTS]
host_segment = 5
sourcetype = syslog

mudricd
Explorer

Thanks a lot man!
Everything works fine now!
My hosts are finally showing up 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...