topic Re: How do I seperate different data after splunk forward in Knowledge Management

How do I seperate different data after splunk forward

perlish — Fri, 05 Oct 2012 15:04:50 GMT

hi,my log center hava many data was recived through two forward,
for example, the ssh log of 192.168.1.100 firstly send to forward 1 ,and then forward 1 send the ssh log to log center
the php log of 192.168.1.100 firstly send to forward 2 , and then the forward 2 send the php log to log center
but in the log center, it only show host 192.168.1.100

How can i separate ssh log and php log, i want`t separate these by the content,
Because this will need to search all content, will spend lots of time.

Who can you help me?

Thanks.

Re: How do I seperate different data after splunk forward

bmacias84 — Fri, 05 Oct 2012 17:15:24 GMT

Could you clarify? What is log center, an indexer? So do you have UF on server 192.168.1.100? If not how does 192.168.1.100 send data to forwarder? Are you using UFs and intermedate forwarders?

Re: How do I seperate different data after splunk forward

sdaniels — Mon, 28 Sep 2020 12:34:30 GMT

Please take a look at this information from our online documentation. You should have a separate sourcetype for ssh logs and for php logs.

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Whysourcetypesmatter
http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configureyourinputs

Below is the list of pretrained sourcetypes in Splunk.

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Listofpretrainedsourcetypes

Example when you bring ssh logs into splunk they should have the sourcetype linux_secure. In the inputs.conf file on the forwarder it should say sourcetype=linux_secure in the monitoring stanza. That will allow splunk to break out the appropriate fields for you at search time.