Splunk Search

Can you help me build a regex that would parse %host% from the following log directories?

meet_vadaria
Engager

I am trying to use host_regex in input.conf
I have log directories as,

/var/log/rsyslog/%year%/%month%/%date%/%host%/syslog

$host$ can be any of following three,
abc-i-1234adfd-foo1 
xx.xx.xx.xx
ip-xx-xx-xx-xx.ec2.internal

thanks,

0 Karma

bjoernjensen
Contributor

Hey,

I think the easiesst way is if you use host_segment.

For you this would be
host_segment = 7

See: https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

If set to N, Splunk software sets the Nth "/"-separated segment of the path as 'host'.
For example, if host_segment=3, the third segment is used.

Cheerz,
Björn

meet_vadaria
Engager

I tried host_segment = 7. I was actually using that. It was working fine until I had %host% = ip-xx-xx-xx-xx.ec2.internal or abc-i-1234adfd-foo1 .

now, I got this new condition where I am getting ip (XX.XX.XX.XX) in %host%. in this specific case, splunk forwarder is not able to extract IP from that field and it's sending logs with default host (splunk forwarder's hostname) field.

as it's not working, I want to try out host_regex and see if that works.

0 Karma

prakash007
Builder

try any one of this in your inputs.conf for host_regex, it helps if you can post the year/month/data format as well to test the regex...

host_regex = /var/log/rsyslog/\d+/\d+\/\d+/([\w\d\\.-]+)\/syslog
host_regex = \/var\/log\/rsyslog\/\d+\/\d+\/\d+\/([\w\d\\.-]+)\/syslog

lookup this Splunk doc..

http://docs.splunk.com/Documentation/Splunk/7.2.1/Data/Setadefaulthostforaninput#Set_the_event_host_...

0 Karma

meet_vadaria
Engager

I tried that. it's working only with following 2 %host% values
abc-i-1234adfd-foo1
ip-xx-xx-xx-xx.ec2.internal

it's not able to extract 3rd value which is xx.xx.xx.xx (IP)

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...