#Splunk inputs.conf xml update#
#Splunk inputs.conf xml full#

Set the event host with the host_regex attribute For more information on configuration files in general, see About configuration files in the Admin Manual. You can set up dynamic host extraction rules by configuring nf. Use the nf file to set a default host dynamically You can test regular expressions by using them in searches with the rex search command. For example, if you want to index an archived directory and the name of each file in the directory contains relevant host information, you can extract this information and assign it to the host field. This method dynamically extracts the host value for a file or directory input, either from a segment of the source input path or from a regular expression. Click Review to continue to the Review page.In the Host field value field, enter the host name for the input.On the Input Settings page in the Host section, click Constant Value.

If you specified a directory, the Set Source Type page does not appear. (Optional) Set the source type for your new input.Specify the file or directory that you want to monitor, and specify any allow lists or deny lists.On the Files & Directories page, click New to add an input.When you create an input, you must follow a different process to set a default host. Enter the static host value for the input in the Host field value field.In the Host section, select constant value from the Set host drop-down list.

#Splunk inputs.conf xml update#

On the Files & Directories page, click the name of an existing input to update it.

On Splunk Web, click Settings > Data Inputs.

To set a default host statically on an existing input, follow these steps: To set the default host when creating a new input, see Set a default host for a new input later in this topic. On Splunk Enterprise, you can define a host for a file or directory input whenever you add or edit an input of that type. Use Splunk Web to set a default host statically If you use Splunk Cloud Platform, you configure this setting on the machines where you run the universal forwarder. When you edit the nf file, set the host setting in the stanza that defines the input. To specify a host value for a monitored file or directory input, you can edit the nf configuration file. See Define and manage tags in Settings in the Knowledge Manager Manual.Įdit the nf configuration file to set a default host statically Instead, you must tag the host value to the existing events. You cannot assign a default host value to data that is already indexed. This method applies a single default host value to each event that a specific file or directory input generates.Ī static host value assignment affects only new events that a certain input generates. See Set host values based on event data.Ĭurrently, you cannot enable the setting of default host values for network (TCP and UDP) or scripted inputs. You can also assign host values to events that come through a particular file or directory input based on their source or source type values as well as other kinds of information.

#Splunk inputs.conf xml full#

If you set the host value dynamically, the Splunk platform extracts the same host name from the source input using a regular expression or segment of the full directory path of the source. If you set the host value statically, the Splunk platform assigns the same host to every event received from a designated file or directory input. You cannot configure host names in Splunk Web. On Splunk Cloud Platform, you must use a universal forwarder to assign host values as part of collecting data to send to Splunk Cloud Platform. You can set the host statically or dynamically. You can set a host value for all data from a particular file or directory input on the universal forwarder and Splunk Enterprise. Set a default host for a file or directory input