Getting Data In
Highlighted

What is the best practice to write monitor stanzas for onboard Network logs from multiple hosts on server?

Explorer

We have to onboard logs from more than 1200 network hosts which reside on a single server.
What is the best practice to write the monitor stanzas? Should we write stanza for each host or is there any other easy way to onboard?

0 Karma
Highlighted

Re: What is the best practice to write monitor stanzas for onboard Network logs from multiple hosts on server?

SplunkTrust
SplunkTrust

hello there,

take a look at this doc, hopefully you will find it helpful.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Specifyinputpathswithwildcards

0 Karma
Highlighted

Re: What is the best practice to write monitor stanzas for onboard Network logs from multiple hosts on server?

Explorer

There are more than 1200 IP's with different ranges. Writing a wildcard can be difficult. Any other way

0 Karma
Highlighted

Re: What is the best practice to write monitor stanzas for onboard Network logs from multiple hosts on server?

SplunkTrust
SplunkTrust

when you say "network hosts" do you mean switches, routes, etc?

0 Karma
Highlighted

Re: What is the best practice to write monitor stanzas for onboard Network logs from multiple hosts on server?

Explorer

Yes exactly everything from network devices

0 Karma
Highlighted

Re: What is the best practice to write monitor stanzas for onboard Network logs from multiple hosts on server?

SplunkTrust
SplunkTrust

i think syslog-ng or rsyslog is the easier solution.
leverage one of them to write the files to a nice structure and then use the monitor stanza with wild cards and host segment to assign the proper host name to each log

0 Karma
Highlighted

Re: What is the best practice to write monitor stanzas for onboard Network logs from multiple hosts on server?

Ultra Champion

Sounds like you have the network sources being collected onto a remote host where they are persisted by log files (like a syslog setup).

Therefore, how about one monitor stanza on the host that will search through the sub-directories. You can then use the configuration file settings like host_segment or host_regex to dynamically assign the true network source's hostname.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#MONITOR:

0 Karma