We are using the agent properties to import the filePath, sourceHostName, and fileName based on the regex, (/.*?/.*?/(.*?)/)(\w+.log). The string bing parsed looks similar to /opt/mnt/TESTServerName/file1.log and parses as follows:
filePath = /opt/mnt/TESTServerName/
sourceHostName = TESTServerName
fileName = file1.log
The Question we have, how can you add a string constant to the information to be included into the sourceHostName variable? Such that you add say ".test.com" - giving you "TESTServerName.test.com" as the contents of the sourceHostName variable being sent up stream to ArcSight ESM. We have discovered that not all of the entries will properly give the IP Address, etc. without having the fully qualified name available.
Has anyone done anything similar and can you provide guidance.
Re: Agent.Properties Question
I have used similar in the parser's property file. However, I am not sure how this could be used in the agent[x].extractfieldnames= parameter in the agent.properties files of a connector.
Apologies - looking back at the original post - it is not as clear as I had hoped. We are using the Agent.Properties files parameters: