topic Re: Identifying multiple log streams on multiple hosts with the same paths (e.g. multiple JVM logs) in Splunk Search

Identifying multiple log streams on multiple hosts with the same paths (e.g. multiple JVM logs)

aoates — Thu, 10 Jun 2010 19:19:55 GMT

what options are available to make it clear to Splunk that particular log streams come from named environments and applications even if that information is

not in the logs themselves
not a function of hostname or IP (since 1 host may have multiple JVMs, each with multiple
not distinguishable by source/filename since the set of log streams for an application will be identical to that same application across numerous distinct environments

Re: Identifying multiple log streams on multiple hosts with the same paths (e.g. multiple JVM logs)

gkanapathy — Thu, 10 Jun 2010 21:45:14 GMT

Assuming that you can identify the environment and application from a combination of host and source file path (I have to imagine that this is possible, since even without Splunk they would have to be able to figure this out), then you can just use a lookup table on the host and source (or a field that is extracted from a part of the source path). It's likely that there is some excel spreadsheet or table that already has this information that could be the basis for this lookup table.