topic Organizing Log Data In Splunk in Getting Data In

Organizing Log Data In Splunk

shahamit — Thu, 18 Apr 2013 13:21:04 GMT

I have installed Splunk 5.0.2 and a universal forwarder on one of the application servers to forward glassfish logs to splunk central servers.
After adding a monitor I see all the glassfish log files as individual sources on the Splunk Search dashboard. Instead I visualize the log data to be grouped into multiple logical/custom categories.

Is there a way to tag log data while adding a monitor? Log files could then have multiple tags which could be seen as different source types. Logs from different servers tag'd with same tag would be clubbed under the same group. (Just as we tag questions on this discussion forums).
Is there a way to customize the search dashboard to remove the source section? Our search use cases would never involve search through individual source files instead search would mostly be done on group of source files? Grouped into a logical category as a tag mentioned in the first point.
How can we delete source or sourcetype from my splunk server? This is slightly a off topic question but since I want to reorganize my log data I would want to clean up old data and reconfigure the search dashboard.

Thank you.

Re: Organizing Log Data In Splunk

dart — Thu, 18 Apr 2013 21:31:14 GMT

The standard way to label data in Splunk is to use the sourcetype field, with a sourcetype setting in your monitor stanza:

[monitor:///var/log/glassfish]
sourcetype=glassfish

source,sourcetype and host are all fields that can be tagged like any other in Splunk

You can customise the dashboard by editing the XML for the dashboard_live to change the summary page. For example, you could replace the search with a query using the rest command to get a list of tags, like so : | rest /services/saved/tags count=0 | search field_name_value=host* | rename tag_name as tag | fields tag. I'm not sure that I'd recommend this though.
1. You can't delete sources or sourcetypes as these are metadata about the indexed events. However you can alias sourcetypes to a new name.

Re: Organizing Log Data In Splunk

shahamit — Fri, 19 Apr 2013 02:15:01 GMT

Can I add multiple values to the sourcetype property? (as I mentioned in my question). Regarding my 3rd question about deleting source and sourcetypes, so there is no mechanism to clean up old data?