Many indexes for many hosts? (no hostname in the logs)

Cesaredf — Tue, 05 May 2015 10:57:12 GMT

Hi all,

I have a doubt about which can be the best practice about indexing if:

I have several splunk client forwarding to the same splunk server the same logs folder. Each night the logs are updated but no logs contain the host name to distinguish among them.

Now my doubt/question is: should I use different indexes per hosts? in such a case a could use different clones of the same app on each host right?

Does anybody has a better how-to or best practice?

Many thanks in advance Cdf.

Re: Many indexes for many hosts? (no hostname in the logs)

satishsdange — Tue, 05 May 2015 11:02:05 GMT

You can mention hostname in inputs.conf as shown below -

[default]
host = cisco_router1

[monitor:///opt/log/cisco_router1/cisco_ironport_web.log]

So that whenever indexer receives data from UF, it will have hostname.