Add a tag (i.e.: environment) to events on a server class.

gmjunior — Mon, 28 Sep 2020 19:53:25 GMT

I have multiple environments (QA, PreProd, Prod) sending data to splunk, and I'm using deployment server to manage all forwarders.
I'm thinking of creating an "app" called Linux, that will "configure" or "add" the input I want to monitor for that specific kind app (i.e: Linux), but I want to separate the data into different indexes (or tag them in some way) by environment but I didn't realize how can I do that, if possible.

Ex:
/etc/deployment-apps/linux/local/inputs:
[monitor:///var/log/messages]
disabled = false
sourcetype = linux_messages_syslog
[monitor:///var/log/secure]
disabled = false
sourcetype = linux_secure

Then I would want to tie this app to various server-class. Something like:
LinuxProd, LinuxQA, etc.
And for that tie, I want to set the index. LinuxQA will have the same inputs as LinuxProd but different indexes.

I know I can achieve that by creating different apps with, something like this:

Ex:
/etc/deployment-apps/linux_qa/local/inputs:
[monitor:///var/log/messages]
disabled = false
sourcetype = linux_messages_syslog
index = linux_qa

[monitor:///var/log/secure]
disabled = false
sourcetype = linux_secure
index = linux_qa

And /etc/deployment-apps/linux_prod/local/inputs:

[monitor:///var/log/messages]
disabled = false
sourcetype = linux_messages_syslog
index = linux_prod

[monitor:///var/log/secure]
disabled = false
sourcetype = linux_secure
index = linux_prod

But that doesn't feel right. Any help would be really appreciated.
Thanks

Re: Add a tag (i.e.: environment) to events on a server class.

martin_mueller — Tue, 12 May 2015 22:16:08 GMT

I'd recommend setting up separate splunk environments for qa and prod that each have an index called linux. Then you can use one without affecting the other and reuse your apps.

Re: Add a tag (i.e.: environment) to events on a server class.

gmjunior — Wed, 13 May 2015 12:48:10 GMT

Thank you for your comment Martin, but that's not the best option for me, I would have to create 4 new environments, I have 3 acceptance environments (qa) plus preprod. Prod is already separated, but I don't need more granularity then that.

Any other options?

topic Re: Add a tag (i.e.: environment) to events on a server class. in Getting Data In

Add a tag (i.e.: environment) to events on a server class.

Re: Add a tag (i.e.: environment) to events on a server class.

Re: Add a tag (i.e.: environment) to events on a server class.