Getting Data In

How to selectively monitor paths for hosts that contain same type of paths


Hello Experts,

I need help in resolving one of the issue that I am facing while trying to discard events that below to specific monitoring path. So here is the issue.

Our requirement is such that we have to group servers based on application. Now when we are grouping them based on app, the server for which some path is not required to be monitored is also getting ingested since I am unable to selectivley monitor path based on app for any host.

For example, I have app--> app1 and app2 with servers app1h1, app1h2 and app2h1,app2h2 respectively.

Path to be monitored for app1 with host app1h1 and app1h2 is

Path to be monitored for app2 with host app2h1 and app2h2 is

Now the issue is since both of these paths are present in all of these hosts so when we mention these paths in input file, for host app1h1 and app1h2 which was supposed to be monitored for /var/log only, also start sending logs under /applogs/portal and same go for app2h1 and app2h2 which also starts sending logs for /var/log rather than just sending it for /applogs/portal.

We just want to achieve specific path to be monitored for host that are required.

I checked for filtering out based on blacklist by using regex but it didn't work under monitoring stanza. Tried to find pattern where I can corelate events based on host so that I can write some regex, but that didn't seemed to work (for this I am not sure if what I have done was correct).

Any help or suggestion would be really helpful.

Thank you.

0 Karma

If you are using DS for configuring inputs, I propose to you to use two serverclass for those servers based on where you want to collect logs. This is more easy and also save resources than try to get rid of collected events later.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...