Getting Data In

Adding new data to Splunk

indikawimalasir
New Member

Hi,

We have a new Splunk system as the new log management system. Previously we used Manage Engine Enterprise Log Management. Ther about large amount of data that I need to get accross to the Splunk.

ELA indexed data is not encryoted. So I just copied the data files to the Splunk server local drive and then ran the add files/directoris to preview it and it looks ok.
My question is is this the right way to do this. Sicen I am going to frozen this data after loading to splunk I am going to create a new indeexed so it will not get confused with teh current data coming in. This is once of operation and once I am through with all the data to Splunk then ELA will be decommisioned.

Also these data consits of Windows event logs Active Direcoty , Linux and Network device syslogs. When I load these to Splunk how will it pickup the source types? Do I have manually mentioned the source type?

Thanks
Indika

Tags (5)
0 Karma

piebob
Splunk Employee
Splunk Employee

it sounds to me as though you're going about this correctly--bringing your legacy data into a separate index is a good call. one thing to make sure you understand is how Splunk archives/freezes data, described here:
http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy

in terms of the source types, if your data is of a standard format (AD, OS, and network devices are all pretty standard), Splunk should do the right thing by default. read more about that here:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Whysourcetypesmatter
http://docs.splunk.com/Documentation/Splunk/5.0/Data/Listofpretrainedsourcetypes

hope this is useful.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...