How to perform search among multiple instances based on instance name?

cdavistt — Tue, 10 Jun 2014 18:40:42 GMT

I run multiple instances of the same application on a server. Each instance generates its own set of log files, and I want to be able to perform searches based on the instance.

The log files are all located by the following path:

/var/log/myapp/instances//engine/engine*.log

I need a way to perform searches based on the instance name . The instance name is NOT contained in the log data, only in the file path.

If I wanted to usurp the "host" field, I could use the features of inputs.conf that allow me to extract the host from the file path. I am not sure this is a good solution for me, because I have multiple hosts doing this multiple instance thing and I would rather know the real host as well as the instance.

Any suggestions?

Re: How to perform search among multiple instances based on instance name?

aweitzman — Tue, 10 Jun 2014 20:03:31 GMT

The file name should show up in the source field, so you might try something like this:

your-search-goes-here | rex field=source "/var/log/myapp/instances/(?<instance-name>\w+)/(.*)"

This should pull out your instance name into a field called instance-name that you can then work with.

topic How to perform search among multiple instances based on instance name? in Splunk Search

How to perform search among multiple instances based on instance name?

Re: How to perform search among multiple instances based on instance name?