Getting Data In

How to monitor the same log location from different servers with different source names?

aak2
New Member

Hi,

I have the same log file locations with same file names in 3 different VMs. I want to differentiate them with source name in the same index and sourcetype. Here is my inputs.conf stanza:

[monitor:///data02/logs/ConnectionServer/logs/ConnectionServer.log]
sourcetype=jboss_server
source=app_prod_node1
index=prod_app
ignoreOlderThan=1d
0 Karma

lguinn2
Legend

That is not the best way to do this. Let the source default to the file name. Set the host to the hostname of the VM. Differentiate using the the host name, not the source name.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...