Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to use a portion of the hostname in your inputs.conf monitor path?

$
0
0
Got a bunch of logs to pickup from different machines. Evidently each machine has a share to the other machines, so I need to only pickup the log in the directory matching with the actual host name. How can I get the last 4 digits from the host name, and use that in my inputs.conf to pickup only the log files in that subdirectory? Tried different combinations of host_segment but not getting anything that works. **Server Name (Log Path)** abcserver1001 (/opt/log/AppName_1001/server.log) abcserver1002 (/opt/log/AppName_1002/server.log) abcserver1003 (/opt/log/AppName_1003/server.log) abcserver1004 (/opt/log/AppName_1004/server.log) abcserver1005 (/opt/log/AppName_1005/server.log) Thanks in advance!!! Joe

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>