https://community.splunk.com/t5/Getting-Data-In/Logging-for-Splunk-Best-Practices-or-Tips/m-p/20219#M2937 <P>Just getting started with Splunk. I'm looking to get better instrumentation and visibility into our systems. In some cases this could be for debugging, in other cases for audit-trail type uses. </P> <P>Since I'm going to (re)write all of our logging code in these systems, does anybody have any suggestions? </P> <P>Certainly one thing I'm looking to accomplish is "joining" events across log files as they flow through our system. Aside from that, my use cases seem pretty basic. But since i'm in this position where I can design my logs just for splunk I thought people who've been doing this for a while could have some tips that might make my life easier later on. </P> <P>Thanks!<BR /> Shane</P> Sat, 28 Jul 2012 00:06:42 GMT shaneharter 2012-07-28T00:06:42Z https://community.splunk.com/t5/Getting-Data-In/Logging-for-Splunk-Best-Practices-or-Tips/m-p/20219#M2937 <P>Just getting started with Splunk. I'm looking to get better instrumentation and visibility into our systems. In some cases this could be for debugging, in other cases for audit-trail type uses. </P> <P>Since I'm going to (re)write all of our logging code in these systems, does anybody have any suggestions? </P> <P>Certainly one thing I'm looking to accomplish is "joining" events across log files as they flow through our system. Aside from that, my use cases seem pretty basic. But since i'm in this position where I can design my logs just for splunk I thought people who've been doing this for a while could have some tips that might make my life easier later on. </P> <P>Thanks!<BR /> Shane</P> Sat, 28 Jul 2012 00:06:42 GMT https://community.splunk.com/t5/Getting-Data-In/Logging-for-Splunk-Best-Practices-or-Tips/m-p/20219#M2937 shaneharter 2012-07-28T00:06:42Z https://community.splunk.com/t5/Getting-Data-In/Logging-for-Splunk-Best-Practices-or-Tips/m-p/20220#M2938 <P>This is a pretty good starting point: <A href="http://dev.splunk.com/view/logging-with-splunk/SP-CAAADP5">http://dev.splunk.com/view/logging-with-splunk/SP-CAAADP5</A></P> <P>What I can add from my experience is that printing the following things in every event is really valuable:</P> <UL> <LI>The severity of the event (ie. DEBUG/INFO/WARN/ERROR)</LI> <LI>A thread identifier (Some sequential or random string that identifies the current thread)</LI> <LI>The source of the log event (ie. class, function or filename)</LI> </UL> Sat, 28 Jul 2012 00:55:43 GMT https://community.splunk.com/t5/Getting-Data-In/Logging-for-Splunk-Best-Practices-or-Tips/m-p/20220#M2938 ziegfried 2012-07-28T00:55:43Z https://community.splunk.com/t5/Getting-Data-In/Logging-for-Splunk-Best-Practices-or-Tips/m-p/20221#M2939 <P>The identifier is a great point but missed by some and when combined with transaction you have a great tool for troubleshooting and debugging process/thread/event specific execution</P> Sat, 28 Jul 2012 09:48:33 GMT https://community.splunk.com/t5/Getting-Data-In/Logging-for-Splunk-Best-Practices-or-Tips/m-p/20221#M2939 Drainy 2012-07-28T09:48:33Z https://community.splunk.com/t5/Getting-Data-In/Logging-for-Splunk-Best-Practices-or-Tips/m-p/20222#M2940 <P>The logging content referred to above is now here: <A href="http://dev.splunk.com/view/logging/SP-CAAAFCK">http://dev.splunk.com/view/logging/SP-CAAAFCK</A> </P> Thu, 16 Mar 2017 17:58:14 GMT https://community.splunk.com/t5/Getting-Data-In/Logging-for-Splunk-Best-Practices-or-Tips/m-p/20222#M2940 mtevenan_splunk 2017-03-16T17:58:14Z