topic Multiple error_log files in Getting Data In

Multiple error_log files

rwssoccer1 — Tue, 23 Nov 2010 22:52:20 GMT

Maybe you can help me out with something. I have multiple files of the same type, error_log files, that are named different. An example would be /var/log/httpd/error_log, /var/log/httpd/error_log-1..etc.....the data input is set to be "/var/log/httpd/error_log*" what is the best way do this instead of having separate sources for these logs to have it under one source called access_log?

Re: Multiple error_log files

simuvid — Tue, 23 Nov 2010 23:56:35 GMT

You can simply override the source setting either in the UI, while defining the new DataIput, or in the inputs.conf file, with something like:

[monitor:/var/log/httpd/error_log*]
disabled = false
followTail = 1
host = apache-1.splunk.com
sourcetype = access_combined
source = access_log

Hope that helps?

Cheers,

simuvid

Re: Multiple error_log files

rwssoccer1 — Wed, 24 Nov 2010 01:07:29 GMT

Awesome! works like a charm.. Thank you!