Getting Data In

best sourcetype for tomcat logs

raindrop18
Communicator

I have 3 tomcat logs I want to push to splunk, and I would like to know which is the best source-type

[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=
[monitor:///opt/tomcat/logs/logback.log]
sourcetype=
[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=

Thanks,

Tags (2)
0 Karma

chanfoli
Builder

Firstly, your first and third monitor stanzas above appear to be the same. I don't know of any specific extractions for tomcat logs that are part of any built-in "pretrained" sourcetypes, with that, and because it is so simple to do, I would create your own sourcetypes for each distinct type of data. This will help you validate that the files are getting parsed for event boundaries and timestamps correctly and make it easier to apply your field extractions and other knowledge objects to the different types of data in the future.

I suggest using the data previewer which you can access from splunk web via "add data". This will let you set and validate event breaks, timestamp extraction etc. for each type of data and create the appropriate props.conf stanza for you. In the past, the log4j sourcetype has worked for similar apps for me, but I prefer to create sourcetypes for every distinct type of data.

raindrop18
Communicator

thanks, great idea. so the custom sourcetype should be configure on controller or can be on forwarder.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...