Getting Data In

Issue with specifying sourceype when logging data from multiple servers

srividyareddy
New Member

While ingesting the data all the logs from the server are falling into single source type. Can any one suggest me how data should be ingested so that source type are classified?

0 Karma

jkat54
SplunkTrust
SplunkTrust

You add the sourcetype on the input in inputs.conf. If you are doing tcp/udp inputs you will need to dos transform based on the source ip/hostname. If you are monitoring other stuff like log files, event logs, performance counters, etc... then it's just a sourcetype=yourSourtceTypeHere in the inputs.conf stanzas.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi srividyareddy,
why all your logs have the same sourcetype? in this way you cannot correctly parse different logs.
Are you receiving logs from Forwarders or syslog or what?

Anyway, if there are some regexes that permit you to override sourcetype value you could use the method described at https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides or http://docs.splunk.com/Documentation/Splunk/latest/Data/Bypassautomaticsourcetypeassignment but it's better to assign sourcetype in Forwarders or syslog inputs.

The best way is to create a Technical Add-on with an inputs.conf with the correct sourcetype assignment, distributing it to your servers using a Deployment server.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...