Define host assignment for an input

Use these instructions if you want to explicitly set a host value for all data coming in via a specific configured input. You can set host statically for every event in the same input, or dynamically using regex or segment on the full path of the source. If you need to assign a different host for different sources or sourcetypes in the same input, use the instructions to extract host per event instead.

Statically

This method will assign the same host for every event for the input.

Also, this will only impact new data coming in via the input. If you need to correct the host displayed in SplunkWeb for data that has already been indexed, you will need to tag hosts instead.

via SplunkWeb

Whenever you add a data input in SplunkWeb, you can set the host through the following interface:

Choose Constant value to assign a static value as host for each event that comes from your data source. Enter the value for host in the DNS name or IP address box.

via configuration files

You can edit inputs.conf to specify a host value. Include a host = attribute within the appropriate stanza in $SPLUNK_HOME/etc/bundles/local/inputs.conf:

[<inputtype>://<path>]
host = $YOUR_HOST
sourcetype = $YOUR_SOURCETYPE
source = $YOUR_SOURCE

Set up your inputs.conf stanza or edit existing ones that you have added through the CLI or SplunkWeb.

Example:

[tcp://10.1.1.10:9995]
host = webhead-1
sourcetype = access_common
source = //10.1.1.10/var/log/apache/access.log

This will set the host as "webhead-1" for any events coming from 10.1.1.10, on TCP port 9995.

Dynamically

Use this method if you want to extract the host name from a segment of the source input. For example, if you have an archived directory you want to index, and the name of each file in the directory contains relevant host information, you can use Splunk to extract this information and assign it to the host field.

via SplunkWeb

Follow the steps outlined above. However, instead of choosing Constant value, you can choose either:

Regex on path: Choose this option if you want to extract the host name via a regular expression. Enter the regular expression for host extraction in the regular expression box.

Segment in path: Choose this option if you want to extract the host name from a segment in your data source's path. Enter the segment number in the segment # box.

via configuration files

You can set up dynamic host extraction rules when you are configuring inputs.conf. You can add the following attribute/value pairs to override the host field.

host_regex = <regular expression>
    If specified, the batch monitor will use the specified regular expression
    to extract the host from the filename of each input. Specifically the first
    group of the regex is used as the host. If the regex fails to match, the
    "host =" attribute is used as the host.

host_segment = <integer>
    If specified, the batch monitor will use the specified '/' separated
    segment of the path as the host of each input. If the value is not an
    integer, or is less than 1, the "host =" attribute is used as the host.

Example:

[tail://apache/logs/]
host_segment = 3
sourcetype = access_common

This will extract the host name as the third segment in the path apache/logs.

Previous: Set default host for a Splunk server | Next: Tag hosts

Comments

I didn't initially set up my transferred logs to use host_segment, so once I did that I tried to reconfigure the input to use segment 3 in a directory like /home/splunkuser/server1/, but it just wouldn't recognize the different hosts. I had to do a ./splunk clean all at the CLI in order to make it work... This probably isn't the best way to do it - I never tried removing the input altogether and re-adding it, which might have worked.
Posted by pr0le on Jan 02 2008, 2:06pm