How to find which Data Source an event is originating from

mninansplunk — Thu, 24 Oct 2024 20:27:01 GMT

Hello,

I'm having a hard time trying to find what data source events from a search are originating from, the Search is:

source="/var/www/html/PIM/var/log/webservices/*"

I've looked thru the "Files % Directories" (Which I thought I would find it in there) and the rest of the Data Inputs, but can't seem to locate it anywhere.

A side question 🙂 I tried creating a new Files % Directories Data Input by putting the full Linux path like below:

//HostName/var/www/html/PIM/var/log/webservices/*

But It says Path can't be empty. I'm sure this is probably not how you format a Linux path, just couldn't find what I'm doing wrong.

Thanks for any help at all,

Newb

Re: How to find which Data Source an event is originating from

sainag_splunk — Fri, 25 Oct 2024 02:59:58 GMT

Hi @mninansplunk

If you're not sure which index contains your data, start with this search:

| tstats count where source="/var/www/html/PIM/var/log/webservices/*" by sourcetype index host

This is a fast way to find which indexes contain your data and see the associated hosts and sourcetypes.

Once you know the right index, you can do a more detailed search:

index=<your_index> source="/var/www/html/PIM/var/log/webservices/*" | stats count by source sourcetype host

For Files & Directories input - was it a typo there? single forward slashes like this?

/HostName/var/www/html/PIM/var/log/webservices/*

make sure file permissions on your input directory and your Splunk forwarder has access to the path

Refer: https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/GetthetutorialdataintoSplunk
https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/GetstartedwithSearch
https://www.splunk.com/en_us/blog/customers/splunk-clara-fication-search-best-practices.html

If this helps, Please UpVote.

topic Re: How to find which Data Source an event is originating from in Getting Data In

How to find which Data Source an event is originating from

Re: How to find which Data Source an event is originating from