We're using Syslog-ng in our environment and have a forwarder setup on syslog-ng to forward the logs to Splunk. But when they're indexed in Splunk, the sourcetype is "syslog". Is it possible to set this to the actual source type? For example our syslog-ng directory structure looks like such:
/logs/log-type/hostname/
I want to be able to set log-type to be the sourcetype in Splunk. It has to be possible!
You would have to set up different monitor stanzas in inputs.conf
on the forwarder, e.g.;
[monitor:///logs/nginx/*/]
index = your_index
sourcetype = nginx
host_segment = 3
[monitor:///logs/cisco/*/]
index = your_index
sourcetype = cisco
host_segment = 3
etc etc
If you do not specify sourcetype (which I assume you have not done) Splunk will probably identify and classify it as syslog
. And syslog
is a sourcetype (the only one I think) where Splunk will automatically extract and set the host for each event in the log individually, i.e. not on a per file basis.
Therefore you will also have to set the host
value manually, but the host_segment
lets you set this from the path being monitored.
Hope this helps,
Kristian
In the inputs file, I have this and it worked:
[monitor:///logs/static-httpd-error-log/*/*.log]
sourcetype = static-httpd-error-log
index = main
host_segment = 3
Thanks for the help!
you are most welcome. /k
You would have to set up different monitor stanzas in inputs.conf
on the forwarder, e.g.;
[monitor:///logs/nginx/*/]
index = your_index
sourcetype = nginx
host_segment = 3
[monitor:///logs/cisco/*/]
index = your_index
sourcetype = cisco
host_segment = 3
etc etc
If you do not specify sourcetype (which I assume you have not done) Splunk will probably identify and classify it as syslog
. And syslog
is a sourcetype (the only one I think) where Splunk will automatically extract and set the host for each event in the log individually, i.e. not on a per file basis.
Therefore you will also have to set the host
value manually, but the host_segment
lets you set this from the path being monitored.
Hope this helps,
Kristian
This goes on the forwarder? Or should it be on the inputs.conf on the index?