Define host assignment for an input

Use these instructions if you want to explicitly set a host value for all data coming in via a specific configured input. Set host statically for every event in the same input, or dynamically with regex or segment on the full path of the source. To assign a different host for different sources or sourcetypes in the same input, extract host per event.

Statically

This method assigns the same host for every event for the input.

Also, this will only impact new data coming in via the input. If you need to correct the host displayed in Splunk Web for data that has already been indexed, you will need to tag hosts instead.

via Splunk Web

Set host whenever you add a data input through the Data Inputs section of Splunk Web's Admin interface.

Choose Constant value to assign a static value as host for each event that comes from your data source. Enter the value for host in the DNS name or IP address box.

via configuration files

Edit inputs.conf to specify a host value. Include a host = attribute within the appropriate stanza in $SPLUNK_HOME/etc/system/local/inputs.conf. Edit inputs.conf in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information on configuration files in general, see how configuration files work.

Configuration

[<inputtype>://<path>]
host = $YOUR_HOST
sourcetype = $YOUR_SOURCETYPE
source = $YOUR_SOURCE

Set up your inputs.conf stanza or edit existing ones that you have added through the CLI or SplunkWeb.

Example

[tcp://10.1.1.10:9995]
host = webhead-1
sourcetype = access_common
source = //10.1.1.10/var/log/apache/access.log

This will set the host as "webhead-1" for any events coming from 10.1.1.10, on TCP port 9995.

Dynamically

Use this method if you want to extract the host name from a segment of the source input. For example, if you have an archived directory you want to index, and the name of each file in the directory contains relevant host information, you can use Splunk to extract this information and assign it to the host field.

via SplunkWeb

Follow the steps outlined above. However, instead of choosing Constant value, you can choose either:

Regex on path: Choose this option if you want to extract the host name via a regular expression. Enter the regular expression for host extraction in the regular expression box.

Segment in path: Choose this option if you want to extract the host name from a segment in your data source's path. Enter the segment number in the segment # box.

via configuration files

You can set up dynamic host extraction rules when you are configuring inputs.conf. You can add the following attribute/value pairs to override the host field.

host_regex = <regular expression>
    If specified, the batch monitor will use the specified regular expression
    to extract the host from the filename of each input. Specifically the first
    group of the regex is used as the host. If the regex fails to match, the
    "host =" attribute is used as the host.

host_segment = <integer>
    If specified, the batch monitor will use the specified '/' separated
    segment of the path as the host of each input. If the value is not an
    integer, or is less than 1, the "host =" attribute is used as the host.

Example:

[tail://apache/logs/]
host_segment = 3
sourcetype = access_common

This will extract the host name as the third segment in the path apache/logs.

Previous: Set default host for a Splunk server | Next: Tag hosts

Comments

No comments have been submitted.