Getting Data In

How to selectively monitor paths for hosts that contain same type of paths


Hello Experts,

I need help in resolving one of the issue that I am facing while trying to discard events that below to specific monitoring path. So here is the issue.

Our requirement is such that we have to group servers based on application. Now when we are grouping them based on app, the server for which some path is not required to be monitored is also getting ingested since I am unable to selectivley monitor path based on app for any host.

For example, I have app--> app1 and app2 with servers app1h1, app1h2 and app2h1,app2h2 respectively.

Path to be monitored for app1 with host app1h1 and app1h2 is

Path to be monitored for app2 with host app2h1 and app2h2 is

Now the issue is since both of these paths are present in all of these hosts so when we mention these paths in input file, for host app1h1 and app1h2 which was supposed to be monitored for /var/log only, also start sending logs under /applogs/portal and same go for app2h1 and app2h2 which also starts sending logs for /var/log rather than just sending it for /applogs/portal.

We just want to achieve specific path to be monitored for host that are required.

I checked for filtering out based on blacklist by using regex but it didn't work under monitoring stanza. Tried to find pattern where I can corelate events based on host so that I can write some regex, but that didn't seemed to work (for this I am not sure if what I have done was correct).

Any help or suggestion would be really helpful.

Thank you.

0 Karma

If you are using DS for configuring inputs, I propose to you to use two serverclass for those servers based on where you want to collect logs. This is more easy and also save resources than try to get rid of collected events later.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...