I have installed Splunk 5.0.2 and a universal forwarder on one of the application servers to forward glassfish logs to splunk central servers.
After adding a monitor I see all the glassfish log files as individual sources on the Splunk Search dashboard. Instead I visualize the log data to be grouped into multiple logical/custom categories.
Thank you.
The standard way to label data in Splunk is to use the sourcetype field, with a sourcetype setting in your monitor stanza:
[monitor:///var/log/glassfish]
sourcetype=glassfish
source
,sourcetype
and host
are all fields that can be tagged like any other in Splunk
You can customise the dashboard by editing the XML for the dashboard_live
to change the summary page. For example, you could replace the search with a query using the rest command to get a list of tags, like so : | rest /services/saved/tags count=0 | search field_name_value=host* | rename tag_name as tag | fields tag
. I'm not sure that I'd recommend this though.
Can I add multiple values to the sourcetype property? (as I mentioned in my question). Regarding my 3rd question about deleting source and sourcetypes, so there is no mechanism to clean up old data?