Getting Data In

Issue with specifying sourceype when logging data from multiple servers

srividyareddy
New Member

While ingesting the data all the logs from the server are falling into single source type. Can any one suggest me how data should be ingested so that source type are classified?

0 Karma

jkat54
SplunkTrust
SplunkTrust

You add the sourcetype on the input in inputs.conf. If you are doing tcp/udp inputs you will need to dos transform based on the source ip/hostname. If you are monitoring other stuff like log files, event logs, performance counters, etc... then it's just a sourcetype=yourSourtceTypeHere in the inputs.conf stanzas.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi srividyareddy,
why all your logs have the same sourcetype? in this way you cannot correctly parse different logs.
Are you receiving logs from Forwarders or syslog or what?

Anyway, if there are some regexes that permit you to override sourcetype value you could use the method described at https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides or http://docs.splunk.com/Documentation/Splunk/latest/Data/Bypassautomaticsourcetypeassignment but it's better to assign sourcetype in Forwarders or syslog inputs.

The best way is to create a Technical Add-on with an inputs.conf with the correct sourcetype assignment, distributing it to your servers using a Deployment server.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...