Hi all,
I have a doubt about which can be the best practice about indexing if:
Now my doubt/question is: should I use different indexes per hosts? in such a case a could use different clones of the same app on each host right?
Does anybody has a better how-to or best practice?
Many thanks in advance Cdf.
You can mention hostname in inputs.conf as shown below -
[default]
host = cisco_router1
[monitor:///opt/log/cisco_router1/cisco_ironport_web.log]
So that whenever indexer receives data from UF, it will have hostname.