@milesbrennan - Thanks for the post, very helpful.  Have a question around parsing/formatting logs so that they are ingested in splunk with appropriate fields.  Is it common practice to do this in rsyslog before being sent to Splunk?  In my test setup, I have a Rsyslog server with the universal forwarder and then sending them to my splunk instance.  I am new to splunk and logging, so hope the question makes sense. ... View more

Yes, you are correct...that did work,  Greatly appreciate your help! ... View more

HI @venkatasri  - Thanks for the quick reply.  No, I wasn't able to get that to work.  Basically what I am trying to do is extract the FQDN hostname so that I can use it in my input.conf file. Similar to what this guy is doing: https://community.splunk.com/t5/Getting-Data-In/Help-extracting-hostname-with-host-regex-from-path/m-p/478981 ... View more