Getting Data In

How to monitor the same log location from different servers with different source names?

aak2
New Member

Hi,

I have the same log file locations with same file names in 3 different VMs. I want to differentiate them with source name in the same index and sourcetype. Here is my inputs.conf stanza:

[monitor:///data02/logs/ConnectionServer/logs/ConnectionServer.log]
sourcetype=jboss_server
source=app_prod_node1
index=prod_app
ignoreOlderThan=1d
0 Karma

lguinn2
Legend

That is not the best way to do this. Let the source default to the file name. Set the host to the hostname of the VM. Differentiate using the the host name, not the source name.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...