Use one or two TCP/UDP ports for two different sources of Syslog if I want them in separate sourcetypes

[kashyap2702]

In my app, I want Syslog from two different sources in two different sourcetypes (since they both are of different types). I have two options for this:
- enable two ports and assign different sourcetypes to both
- collect them on single port and assign different sourcetypes using regex (will require much analysis of logs)

What is the recommended approach ?

Thanks,
Kashyap

[woodcock]

Always use distinct (in this case 2) ports. Then you can debug problems from the outside using OS tools, too.
If you are stuck using a single port then you should use this project and help contribute to the auto-sourcetypeing RegEx list:
https://github.com/splunk/splunk-connect-for-syslog/wiki

[s2_splunk · Accepted solution]

The best practice approach for syslog collection is to send your log data to a syslog server, apply proper policies in syslog server to write to separate files/folder and use a Universal Forwarder on the syslog server to process the log files the splunky way.

Note that if you send syslog to a Splunk listener, you will lose data every time you have to restart Splunk, e.g. to apply configuration changes. Plus, as you are just finding out, you have to have a separate port for each sourcetype, which gets messy quickly.

[gcusello]

Hi kashyap2702,
if you can I'd prefer the first.
Bye.
Giuseppe