Getting Data In

How can I monitor a directory full of mixed types of logfiles while explicitly applying sourcetypes?

Splunk Employee
Splunk Employee

I have a directory /logdir and it contains various types of files, such as apache logs, syslog files, local applications logs and so on.

Splunk 3.x & 4.0.x doesn't support overlapping input stanzas, so how is this best accomplished?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

The approach is discussed here:

http://www.splunk.com/wiki/Community:Monitoring_a_mixed_sourcetype_directory

First, set up an input stanza that captures all the files you are interested, possibly using whitelist and blacklist regexes.

Second, use props.conf patterns to apply sourcetypes to the file entries.

View solution in original post

Splunk Employee
Splunk Employee

The approach is discussed here:

http://www.splunk.com/wiki/Community:Monitoring_a_mixed_sourcetype_directory

First, set up an input stanza that captures all the files you are interested, possibly using whitelist and blacklist regexes.

Second, use props.conf patterns to apply sourcetypes to the file entries.

View solution in original post

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!