Getting Data In

How do I get multiple sourcetypes from one source?

jldebell
Path Finder

I have one file that I need to pull two sourcetypes from. Here are the details:

i created two independent inputs.conf files.

inputs.conf
[monitor:///var/log/audit/audit.log]
index=sample
sourcetype=sample1



inputs.conf
[monitor:///var/log/audit/audit.log]
index=sample
sourcetype=sample2

My serverclass.conf file is set up with two stanzas:

[serverClass:sample1]
whitelist.0 = /var/opt/specific/to/sample1* 
machineTypesFilter = linux*
restartSplunkd = true
[serverClass:sample1:app:sample1]

[serverClass:sample2]
whitelist.0 = /var/opt/specific/to/sample2* 
machineTypesFilter = linux*
restartSplunkd = true
[serverClass:sample2:app:sample2]

I am using the whitelist to identify key information within the log. The data is coming through with both whitelist details, but it is defaulting to only one sourcetype. My whitelist also contains host information which is also shared. The only thing that separates the sourcetypes is the /var/opt/specific/to/sample* details. I don't think host details matter, so I left these details in. Do I need to add an AND statement in there?

[serverClass:sample1]
whitelist.0 = /var/opt/specific/to/sample1* AND
whitelist.1 = host
machineTypesFilter = linux*
restartSplunkd = true
[serverClass:sample1:app:sample1]

Or is there something else that i should consider?

Thanks, Jennifer

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Serverclass.conf is used for your deployment server. This will not filter your inputs based on the file or event code. The whitelist / blacklist function in serverclass.conf is for host filtering.

You need to create two serverclasses; e.g., Sourcetype1 and Sourcetype2

In the whitelist for each of those, enter the hostname..

 [serverClass:sample1]
 whitelist.0 = myhostforsourcetype1.mydomain.com
 machineTypesFilter = linux*
 restartSplunkd = true
 [serverClass:sample1:app:sample1]

 [serverClass:sample2]
 whitelist.0 = myhostforsourcetype2.mydomain.com 
 machineTypesFilter = linux*
 restartSplunkd = true
 [serverClass:sample2:app:sample2]

In those apps, you define the specific input and sourcetypes as you have done for the inputs.conf.

Refer to documentation for this here: http://docs.splunk.com/Documentation/Splunk/6.2.2/Updating/Useserverclass.conf

jldebell
Path Finder

Thanks for the information. If i am reading this correctly, I need to add the host details in to decipher the difference between the logs? The host details and the source are the same in both instances. It is only the log content that makes it different.

0 Karma

jldebell
Path Finder

Adding a wildcard to see if it will work.

whitelist.0 = ***/var/opt/specific/to/sample2

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...