Add dynamic hostname field for local file source


1 comment

  • Avatar
    Latimer Luis

    Hi Giovanni, 

    Some customers take the approach of parsing out their syslog events during ingest using our Field Extraction Rules. Oftentimes, they'll create a distinct rule to overwrite our _sourceHost metadata field with the name of the server found in the message itself. 

    The main drawback to this approach is that the extracted hostnames will not appear in the auto-complete list when typing in "_sourceHost=" in the query window. 

    Latimer Luis
    Customer Success Manager

    Comment actions Permalink

Please sign in to leave a comment.