Adding new data to Splunk

indikawimalasir — Sun, 25 Nov 2012 22:42:48 GMT

Hi,

We have a new Splunk system as the new log management system. Previously we used Manage Engine Enterprise Log Management. Ther about large amount of data that I need to get accross to the Splunk.

ELA indexed data is not encryoted. So I just copied the data files to the Splunk server local drive and then ran the add files/directoris to preview it and it looks ok.
My question is is this the right way to do this. Sicen I am going to frozen this data after loading to splunk I am going to create a new indeexed so it will not get confused with teh current data coming in. This is once of operation and once I am through with all the data to Splunk then ELA will be decommisioned.

Also these data consits of Windows event logs Active Direcoty , Linux and Network device syslogs. When I load these to Splunk how will it pickup the source types? Do I have manually mentioned the source type?

Thanks
Indika

Re: Adding new data to Splunk

piebob — Mon, 26 Nov 2012 16:06:26 GMT

it sounds to me as though you're going about this correctly--bringing your legacy data into a separate index is a good call. one thing to make sure you understand is how Splunk archives/freezes data, described here:
http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy

in terms of the source types, if your data is of a standard format (AD, OS, and network devices are all pretty standard), Splunk should do the right thing by default. read more about that here:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Whysourcetypesmatter
http://docs.splunk.com/Documentation/Splunk/5.0/Data/Listofpretrainedsourcetypes

hope this is useful.

topic Adding new data to Splunk in Getting Data In

Adding new data to Splunk

Re: Adding new data to Splunk