Getting Data In

Same sourcetype in different TA or APPs

pvuong
Explorer

Hello,

I have a Splunk server which is Indexer and SearchHead. All of the logs are splited to different file by rsyslog in front process.
So i have all log in File format by host like :
/var/rsyslog/HOST1
/var/rsyslog/HOST2
/var/rsyslog/HOST3
/var/rsyslog/HOST4
All input to Splunk is indexed by monitor file method for one or several file (broadcast /var/rsyslog/*)

I installed three apps:
- splunk_app_for_nix( included SA-nix, Splunk_TA_nix) dedicated for Linux, Unix systeme event dashbord.
- cisco_ios (included TA-cisco_ios) dedicated for Cisco Switch event dashbord
- Splunk_CiscoSecuritySuite (included Splunk_TA_cisco-asa) dedicated for ASA event dashbord

My three input are :

  1. For splunk_app_for_nix --> splunk_app_for_nix/local/inputs.conf
    [monitor:///var/rsyslog/linux_HostName*]
    disabled = false
    host_segment = 4
    index = index_nix
    sourcetype = syslog

  2. For cisco_ios ---> cisco_ios/local/inputs.conf
    [monitor:///var/rsyslog/cisco_switch_HostName*]
    disabled = false
    host = cisco_swith_HostName
    index = net_cisco
    sourcetype = syslog

  3. Splunk_CiscoSecuritySuite ---> Splunk_TA_cisco-asa/local/inputs.conf
    [monitor:///var/rsyslog/cisco_asa_HostaName*]
    disabled = false
    host = cisco_asa_Hostname
    index = net_asa
    sourcetype = syslog

My Dashboard of cisco_ios and CiscoSecuritySuite are ok. All events are displayed correctly except the systeme nix .
All log in index "index_nix" arent extracted correctly in according to nix extract.

My question is how SPLUNK know the different "syslog" to use to adapt it to each kind of log : linux syslog, cisco ios syslog or cisco asa syslog ?

Any help is appreciated. Thanks by advance.

Tags (1)
0 Karma

pvuong
Explorer

Hi,

Thanks for your answer.

I wanted to add data to different index for each kind of equipment : index_nix, index_cisco, index_asa to allow the diffrent role permission.
I know that *nix need to create other index like "os", "unix_summary" ....

My question is how SPLUNK can know the different kind sourcetype of the same name "syslog" dedicated and configured in different APPs or TA ("syslog" of cisco ios or "syslog" of splunk_app_for_nix ? ). In this case, which file props.conf or transforms.conf that SPLUNK uses (the cisco one or the nix one ) ?

Thanks for any help

0 Karma

gfreitas
Builder

Hi pvuong,

Splunk just uses the sourcetype, source or host to extract the fields, if you have syslog than it will try to extract fields. It's not recommended to have multiple different styles of data with the same sourcetype. A normal way is to give names for your sourcetypes, for example for Cisco ASA, use sourcetype=cisco:asa, for Cisco router use sourcetype=cisco:router and so on.
Your props.conf and transforms.conf will be related to a sourcetype (most common usage).

0 Karma

pvuong
Explorer

Ok Thanks for your answer. For Cisco asa and Cisoc ios, i have indeed used cisco:asa, cisco:ios for my cisco log sourcetype

So it not recommanded to have multiple different styles of data with the same sourcetype. Why the Apps or TA didn't configured with the default/props.conf to different kind of log like
nix_syslog
ios_syslog
postfix_syslog

instead of the same name "syslog" which can quite lead to confusion ...

Thanks for your answer.

Marie

0 Karma

gfreitas
Builder

Hi,

It's very common that Splunk uses the props.conf and transforms.conf files for configuration on how to extract fields. Does the *nix app requires you to add data to the index_nix or another index? In the README file of the app you can find more information.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...