What is the best practice to write monitor stanzas for onboard Network logs from multiple hosts on server?

[jarapally]

We have to onboard logs from more than 1200 network hosts which reside on a single server.
What is the best practice to write the monitor stanzas? Should we write stanza for each host or is there any other easy way to onboard?

[sloshburch]

Sounds like you have the network sources being collected onto a remote host where they are persisted by log files (like a syslog setup).

Therefore, how about one monitor stanza on the host that will search through the sub-directories. You can then use the configuration file settings like host_segment or host_regex to dynamically assign the true network source's hostname.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#MONITOR:

[adonio]

hello there,

take a look at this doc, hopefully you will find it helpful.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Specifyinputpathswithwildcards

[jarapally]

There are more than 1200 IP's with different ranges. Writing a wildcard can be difficult. Any other way

[adonio]

when you say "network hosts" do you mean switches, routes, etc?

[jarapally]

Yes exactly everything from network devices

[adonio]

i think syslog-ng or rsyslog is the easier solution.
leverage one of them to write the files to a nice structure and then use the monitor stanza with wild cards and host segment to assign the proper host name to each log