topic Re: What sourcetype should I use to index my mongo logs? in Getting Data In

What sourcetype should I use to index my mongo logs?

abrie_strauss — Mon, 18 Aug 2014 13:53:19 GMT

We currently have a mongodb cluster who's logs I would like to index to splunk, but there appears to be no sourcetype for mongo logs, what can be done to index the fields in a way that splunk registers the values at time of index?

Re: What sourcetype should I use to index my mongo logs?

MuS — Tue, 19 Aug 2014 08:01:12 GMT

Hi abrie.strauss,

take a look at this app Hunk App for MongoDB, maybe this can help.

cheers, MuS

Re: What sourcetype should I use to index my mongo logs?

pcrook — Thu, 28 Aug 2014 01:58:16 GMT

I think abrie.strauss is trying to solve the same problem that I am. I am trying to index mongodb.log files rather than analyze the data stored in Mongo itself. I don't think Hunk does that. Ideally, I'd like to say "splunk add monitor -source mongodb.log -sourcetype mongo" and Splunk would properly parse and present Mongo's log data. If Splunk doesn't have a sourcetype for Mongo logs, surely someone else has made one by now, no?