Getting different sourcetypes from the same source

[Na_Kang_Lim]

Hi,

I am configure the apps on the UF from a Deploy Server, and get this weird behavior:

What I am trying to do is assigning the sourcetype "nginx:access" for every file that have this path "/var/log/nginx/access.log*"

[monitor:///var/log]
whitelist = (\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)
blacklist = (lastlog|anaconda\.syslog)
disabled = 0

[monitor:///var/log/nginx]
whitelist = (^access\.log)
sourcetype = nginx:access
disabled = 0

However, upon deploying the apps, I see that there are still numerous weird sourcetypes assigning to the source "/var/log/nginx/access.log".

For example, when running

| tstats values(sourcetype) where index=*_linux source=/var/log/nginx/access.log by source

I got:

access-100
access-13
access-204
access-29
access-66
access-7
access-too_small
access.log-16
access.log-4
access.log-85
access_combined
access_combined_wcookie
nginx:access

 How do I troubleshoot/fix this?

[PickleRick]

Splunk can behave weirdly when you monitor two paths of which one includes the other. For sure there is no automatic exclusion of the "narrower" path from the "wider" one but the overall behaviour can be a bit unpredictable. You can see the effective applied "config" with

splunk list monitor

So the overall best practice is when the paths listed in monitor stanzas don't overlap. If you need to specify separate sourcetypes for different files in a single directory you can use so-called sourcetyper configuration.

Specify the default sourcetype in inputs.conf

[monitor:///var/log/]
sourcetype=whatever

But add overrides in props.conf for specific files

[source:///var/log/nginx/*]
sourcetype=something_else

See https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.4/configure-source-types/over...

[livehybrid]

Hi @Na_Kang_Lim 

Firsly, your /var/log/nginx is specifically targeting access.log (nothing else), you need to update this:

[monitor:///var/log/nginx]
whitelist = (^access\.log*)

 You should probably also exclude this from the first monitor stanza too:

[monitor:///var/log]
whitelist = (\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)
blacklist = (lastlog|anaconda\.syslog|access\.log*)

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PrewinThomas]

@Na_Kang_Lim 

In your first blacklist modify with below,

blacklist = (lastlog|anaconda\.syslog|nginx/access\.log)

And for your second monitor, use direct path.

[monitor:///var/log/nginx/access.log]
sourcetype = nginx:access
disabled = 0

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!