Getting Data In

How to monitor the same log location from different servers with different source names?

aak2
New Member

Hi,

I have the same log file locations with same file names in 3 different VMs. I want to differentiate them with source name in the same index and sourcetype. Here is my inputs.conf stanza:

[monitor:///data02/logs/ConnectionServer/logs/ConnectionServer.log]
sourcetype=jboss_server
source=app_prod_node1
index=prod_app
ignoreOlderThan=1d
0 Karma

lguinn2
Legend

That is not the best way to do this. Let the source default to the file name. Set the host to the hostname of the VM. Differentiate using the the host name, not the source name.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...