Splunk Search

Splunk forwarder to add custom fields for multiple logs

z001k6jr
New Member

I have to setup Splunk for 100 servers, each server will have 5-10 JVMs, Each JVM generates 3-4 log files. I would like to index logs to a central Splunk server and along with data , I would also like to send custom fields. so that I can uniquely search JVM logs or different files. for example a NullPinterException in JVM= "ABC" and in log file Server.log or in jms.log.
How can I design the deployment and custom fields?

The deployment looks like the following
Server A->
JVM 1->
server.log
jakarta.log
httpd.log
jms.log
JVM 2->
server.log
jakarta.log
httpd.log
jms.log

Server B->
JVM 3->
server.log
jakarta.log
httpd.log
jms.log
JVM 4->
server.log
jakarta.log
httpd.log

Tags (1)
0 Karma

jchampagne_splu
Splunk Employee
Splunk Employee

Where are you writing the JVM logs to on the host? What's the full path?

You can use host_regex or host_segment to extract the JVM "hostname" out of the log file path. Splunk would then replace the built-in host field with that value.

http://docs.splunk.com/Documentation/Splunk/6.3.2/admin/Inputsconf

0 Karma

jkat54
SplunkTrust
SplunkTrust

How can I design the deployment and custom fields?

Sorry, but I'm not going to build the solution for you. I recommend you delete this question and only ask specific questions like... I get this error "complete error message" , how can I fix it? Not, I just got a new job as splunk admin and need to know how to setup deployment server and develop applications. The answer to your questions are covered in documentation, best practices, and splunk training sessions. All of which are available to you.

jplumsdaine22
Influencer

Just a question, have you run through the spunk tutorial? http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchTutorial/WelcometotheSearchTutorial

Also I recommend you give this a read first as well: http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Howindexingworks

People will definitely give you a hand but having some familiarity with the basics will make it easier of you to get the answers you need

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...