Getting Data In

How to partition indexed logfiles into multiple sourcetype?

edgarrity
Path Finder

We need to index logfiles from our monitored devices which are partitioned into two segments.  The first segment is CSV.  The last segment are events.

 

col1,col2,col3,…,colN

col1,col2,col3,… ,colN

col1,col2,col3,… ,colN

.

.

.

event1

event2

event3

eventN

 

This data from the logfile needs to be sent to one index with a two sourcetypes.  Sourcetype_csv for the first segment in the logfile and sourcetype_events for the last segment in the logfile.  How do we structure the inputs.conf, props.conf, and transforms.conf for this?

 

We were thinking we could leverage filtering to take advantage that the events are all prefixed and postfixed with “***”.  However, there does not seem to be a way to have the one logfile type partitioned into more than one sourcetype.

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @edgarrity,

if you can find a regex to identify logs of the dirst or of the second type, you have two solutions:

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @edgarrity,

if you can find a regex to identify logs of the dirst or of the second type, you have two solutions:

Ciao.

Giuseppe

edgarrity
Path Finder

Thanks.

That worked.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...