topic Combining files in Getting Data In

Combining files

Jananee_iNautix — Wed, 27 Nov 2013 11:33:19 GMT

I have different log files .I want to combine these log files into a single file .Is this possible in splunk and if so how to do?
Can anyone give me some idea on it

Re: Combining files

martin_mueller — Wed, 27 Nov 2013 14:01:11 GMT

Index them into the same index and/or using the same sourcetype, then filter based on index and/or sourcetype and ignore the source altogether.

Re: Combining files

Jananee_iNautix — Thu, 28 Nov 2013 07:14:31 GMT

Can you suggest some documentation where i could see the process you said in detail.

Re: Combining files

yannK — Fri, 29 Nov 2013 00:43:52 GMT

Why would you do such a thing : Is your intention to export all the events as a single file ?

If you have indexed 2 files /path/to/file1 and /path/to/file2
why not searching on source=/path/to/file1 OR source=/path/to/file2
and have all the events displayed together.

Re: Combining files

Jananee_iNautix — Fri, 29 Nov 2013 06:07:41 GMT

No my intention is to combine the files together into single file before indexing