Getting Data In

How can I monitor a directory full of mixed types of logfiles while explicitly applying sourcetypes?

jrodman
Splunk Employee
Splunk Employee

I have a directory /logdir and it contains various types of files, such as apache logs, syslog files, local applications logs and so on.

Splunk 3.x & 4.0.x doesn't support overlapping input stanzas, so how is this best accomplished?

Tags (1)
1 Solution

jrodman
Splunk Employee
Splunk Employee

The approach is discussed here:

http://www.splunk.com/wiki/Community:Monitoring_a_mixed_sourcetype_directory

First, set up an input stanza that captures all the files you are interested, possibly using whitelist and blacklist regexes.

Second, use props.conf patterns to apply sourcetypes to the file entries.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

The approach is discussed here:

http://www.splunk.com/wiki/Community:Monitoring_a_mixed_sourcetype_directory

First, set up an input stanza that captures all the files you are interested, possibly using whitelist and blacklist regexes.

Second, use props.conf patterns to apply sourcetypes to the file entries.

Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...