Getting Data In
Highlighted

Issue with specifying sourceype when logging data from multiple servers

New Member

While ingesting the data all the logs from the server are falling into single source type. Can any one suggest me how data should be ingested so that source type are classified?

0 Karma
Highlighted

Re: Issue with specifying sourceype when logging data from multiple servers

Legend

Hi srividyareddy,
why all your logs have the same sourcetype? in this way you cannot correctly parse different logs.
Are you receiving logs from Forwarders or syslog or what?

Anyway, if there are some regexes that permit you to override sourcetype value you could use the method described at https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides or http://docs.splunk.com/Documentation/Splunk/latest/Data/Bypassautomaticsourcetypeassignment but it's better to assign sourcetype in Forwarders or syslog inputs.

The best way is to create a Technical Add-on with an inputs.conf with the correct sourcetype assignment, distributing it to your servers using a Deployment server.
Bye.
Giuseppe

0 Karma
Highlighted

Re: Issue with specifying sourceype when logging data from multiple servers

SplunkTrust
SplunkTrust

You add the sourcetype on the input in inputs.conf. If you are doing tcp/udp inputs you will need to dos transform based on the source ip/hostname. If you are monitoring other stuff like log files, event logs, performance counters, etc... then it's just a sourcetype=yourSourtceTypeHere in the inputs.conf stanzas.

0 Karma