How can I monitor two access logs at once without using the regular host\source\sourcetype properties

[shacham]

Hi,

Lets say I have 2 environments(TEST\PROD),
And in each one I have 2 brands with 2 diffrent access logs:
access-brand1.log, access-brand2.log

I'm trying to monitor them both but I'm already using my 'source' for the environments.
('host' and 'sourcetype' are also taken)
Is there any way I can still tell splunk to monitor them separately?

Thanks

[mloven_splunk · Accepted solution]

I'd suggest leaving source to the default (the name of the file (or network port) that the data comes from). This will give the ability to search on individual file names.

To define logical groups within your environment, you can use tags as Anthony suggested.

[mloven_splunk]

If both logs are in the access_combined format, you can just tell Splunk that they're access_combined logs.

[monitor:///path/to/access-brand1.log]
index = myindex
sourcetype = access_combined

[monitor:///path/to/access-brand2.log]
index = myindex
sourcetype = access_combined

The above stanzas should work.

[mloven_splunk]

And while that isn't "wrong", it's not really what source was meant for.

From the docs:

Source -
A default field that identifies the source of the event. In the case of data monitored from files and directories, source consists of the full pathname of the file or directory. In the case of a network-based source, the source field consists of the protocol and port, such as UDP:514.

[shacham]

But I'm already using my 'source' for the environments...
for example: source=PROD

[mloven_splunk]

index=myindex sourcetype=access_combined source="/path/to/access-brand2.log"

EDITED to correct index...

[shacham]

But then how I can filter between the two?
If I want to search only in access-brand2.log, How can I tell splunk to do it?

[mloven_splunk]

shacham,

I'm not really sure what you're asking. Maybe you can clarify?

If you want to monitor both files, you can do something like this:

[monitor:///path/to/access-brand1.log]
index = myindex
sourcetype = brand1_access

[monitor:///path/to/access-brand2.log]
index = myindex
sourcetype = brand2_access

[shacham]

This is one solution, but I'm trying to use diffrent solutions beacuse I want to use automatically recognized source types(pretrained) like:'access_combined'.
Splunk already knows how to properly index pretrained source types and I think it's good practice to use it.

[treinke]

How about setting up tags?

http://docs.splunk.com/Documentation/Splunk/5.0.4/Knowledge/Abouttagsandaliases
http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Tagsconf

You can use tags to:

• Help you track abstract field values, like IP addresses or ID numbers. For example, you could have an IP address related to your main office with the value 192.168.1.2. Tag that IPaddress value as mainoffice, and then search on that tag to find events with that IP address.
• Use one tag to group a set of field values together, so you can search on them with one simple command. For example, you might find that you have two host names that relate to the same computer. You could give both of those values the same tag. When you search on that tag, Splunk returns events involving both host name values.
• Give specific extracted fields multiple tags that reflect different aspects of their identity, which enable you to perform tag-based searches that help you quickly narrow down the results you want. To understand how this could work, see the following example.