Getting Data In

Multiple Sources on a single host

splunktp
Explorer

I have a Splunk 4.1.7, build 95063 instance and am trying to pull logs from Informix DB on Solaris 10. So I had set the inputs.conf of Lightweight forwarder on Informix as follows

[monitor:///usr/informix/mycertaindirectory]
disabled = false
source = Informix

On Splunkweb, I am able to see a lot of logs coming to "source=Informix".

My concern is that it also created some 3,000+ sources, most of which has the format of a common string of file name followed by a incrementing number.

How can I correct this multiple soucres coming from the same host?

Tags (1)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

Source usually correlates to a specific filename. In /usr/informix/mycertaindirectory do you have 3,000+ distinct files?

And when you say 'logs from Informix DB' do you mean the database transaction logs (the Informix physical log and logical log) or do you mean textual log files created by the Informix server process?

A common question that comes up is feeding database transaction logs into Splunk. Because most database transaction logs are in an opaque binary format, and because most database vendors are unwilling to provide documentation about that format, Splunk cannot directly ingest database transaction logs and make sense of them.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...