Getting Data In

How can I monitor a directory full of mixed types of logfiles while explicitly applying sourcetypes?

jrodman
Splunk Employee
Splunk Employee

I have a directory /logdir and it contains various types of files, such as apache logs, syslog files, local applications logs and so on.

Splunk 3.x & 4.0.x doesn't support overlapping input stanzas, so how is this best accomplished?

Tags (1)
1 Solution

jrodman
Splunk Employee
Splunk Employee

The approach is discussed here:

http://www.splunk.com/wiki/Community:Monitoring_a_mixed_sourcetype_directory

First, set up an input stanza that captures all the files you are interested, possibly using whitelist and blacklist regexes.

Second, use props.conf patterns to apply sourcetypes to the file entries.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

The approach is discussed here:

http://www.splunk.com/wiki/Community:Monitoring_a_mixed_sourcetype_directory

First, set up an input stanza that captures all the files you are interested, possibly using whitelist and blacklist regexes.

Second, use props.conf patterns to apply sourcetypes to the file entries.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...