Deployment Architecture

How to index log file from 50 servers

k_harini
Communicator

Hi,
There are around 50 servers for which log files are in same format... I want to track current server status, number of servers up/down at particular time and corresponding drill down etc. In the servers, log files will be in xxx.log format. Now my question is how to index these? Like having 50 different folders to monitor these with server name as source type? Or is there any other better option? Files will be picked up by using forwarders from the servers.

Please provide suggestions. Thanks

Tags (2)
0 Karma
1 Solution

adonio
Ultra Champion

Hello k_harini,
monitor the folder is a good option when using the Universal Forwarder.
have all logs (if they are the same sourcetype) as same sourcetype, Splunk will extract the host field automatically by forwarder so you can always know where the particular event came from.
something like this on the forwarders on 50 servers:

[monitor://full/path/to/log/*.log]
sourcetype = uniqueSourcetype
index = dataIndex

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

Hello k_harini,
monitor the folder is a good option when using the Universal Forwarder.
have all logs (if they are the same sourcetype) as same sourcetype, Splunk will extract the host field automatically by forwarder so you can always know where the particular event came from.
something like this on the forwarders on 50 servers:

[monitor://full/path/to/log/*.log]
sourcetype = uniqueSourcetype
index = dataIndex

hope it helps

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...