Hello,
I'm having a hard time trying to find what data source events from a search are originating from, the Search is:
source="/var/www/html/PIM/var/log/webservices/*"
I've looked thru the "Files % Directories" (Which I thought I would find it in there) and the rest of the Data Inputs, but can't seem to locate it anywhere.
A side question 🙂 I tried creating a new Files % Directories Data Input by putting the full Linux path like below:
//HostName/var/www/html/PIM/var/log/webservices/*
But It says Path can't be empty. I'm sure this is probably not how you format a Linux path, just couldn't find what I'm doing wrong.
Thanks for any help at all,
Newb
| tstats count where source="/var/www/html/PIM/var/log/webservices/*" by sourcetype index host
This is a fast way to find which indexes contain your data and see the associated hosts and sourcetypes.
index=<your_index> source="/var/www/html/PIM/var/log/webservices/*" | stats count by source sourcetype host
For Files & Directories input - was it a typo there? single forward slashes like this?
/HostName/var/www/html/PIM/var/log/webservices/*
Refer: https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/GetthetutorialdataintoSplunk
https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/GetstartedwithSearch
https://www.splunk.com/en_us/blog/customers/splunk-clara-fication-search-best-practices.html
If this helps, Please UpVote.