Getting Data In

How to selectively monitor paths for hosts that contain same type of paths

s_absinthe
Explorer

Hello Experts,

I need help in resolving one of the issue that I am facing while trying to discard events that below to specific monitoring path. So here is the issue.

Our requirement is such that we have to group servers based on application. Now when we are grouping them based on app, the server for which some path is not required to be monitored is also getting ingested since I am unable to selectivley monitor path based on app for any host.

For example, I have app--> app1 and app2 with servers app1h1, app1h2 and app2h1,app2h2 respectively.

Path to be monitored for app1 with host app1h1 and app1h2 is
/var/log

Path to be monitored for app2 with host app2h1 and app2h2 is
/applogs/portal

Now the issue is since both of these paths are present in all of these hosts so when we mention these paths in input file, for host app1h1 and app1h2 which was supposed to be monitored for /var/log only, also start sending logs under /applogs/portal and same go for app2h1 and app2h2 which also starts sending logs for /var/log rather than just sending it for /applogs/portal.

We just want to achieve specific path to be monitored for host that are required.

I checked for filtering out based on blacklist by using regex but it didn't work under monitoring stanza. Tried to find pattern where I can corelate events based on host so that I can write some regex, but that didn't seemed to work (for this I am not sure if what I have done was correct).

Any help or suggestion would be really helpful.

Thank you.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
If you are using DS for configuring inputs, I propose to you to use two serverclass for those servers based on where you want to collect logs. This is more easy and also save resources than try to get rid of collected events later.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...