Getting Data In

How can I monitor a directory full of mixed types of logfiles while explicitly applying sourcetypes?

Splunk Employee
Splunk Employee

I have a directory /logdir and it contains various types of files, such as apache logs, syslog files, local applications logs and so on.

Splunk 3.x & 4.0.x doesn't support overlapping input stanzas, so how is this best accomplished?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

The approach is discussed here:

http://www.splunk.com/wiki/Community:Monitoring_a_mixed_sourcetype_directory

First, set up an input stanza that captures all the files you are interested, possibly using whitelist and blacklist regexes.

Second, use props.conf patterns to apply sourcetypes to the file entries.

View solution in original post

Splunk Employee
Splunk Employee

The approach is discussed here:

http://www.splunk.com/wiki/Community:Monitoring_a_mixed_sourcetype_directory

First, set up an input stanza that captures all the files you are interested, possibly using whitelist and blacklist regexes.

Second, use props.conf patterns to apply sourcetypes to the file entries.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!