Getting Data In

How do I select different sourcetypes for multiple logs coming from multiple servers using rsyslog.conf (no universal forwarders)?

Path Finder

How do I select different sourcetypes for multiple logs coming from multiple servers (no universal forwarders, using rsyslog.conf)? When I set up the input port, it only offers one type of sourcetype choice.

0 Karma
1 Solution

SplunkTrust
SplunkTrust
0 Karma

Splunk Employee
Splunk Employee

Answered, but I wanted to suggest that you consider sending your syslog traffic to a syslog-ng server, do your filtering/tagging there and write to separate files that are then processed by a UF.
Sending syslog traffic directly to your indexer will mean you will lose events whenever you have to restart your indexer.

0 Karma

Path Finder

Or you can follow this RSysLog 8.15.0 guide I wrote specifically for Splunk usage.
https://answers.splunk.com/answers/337489/howto-setup-rsyslog-network-event-log-filtering-ba.html

0 Karma

SplunkTrust
SplunkTrust
0 Karma