Getting Data In

best sourcetype for tomcat logs

raindrop18
Communicator

I have 3 tomcat logs I want to push to splunk, and I would like to know which is the best source-type

[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=
[monitor:///opt/tomcat/logs/logback.log]
sourcetype=
[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=

Thanks,

Tags (2)
0 Karma

chanfoli
Builder

Firstly, your first and third monitor stanzas above appear to be the same. I don't know of any specific extractions for tomcat logs that are part of any built-in "pretrained" sourcetypes, with that, and because it is so simple to do, I would create your own sourcetypes for each distinct type of data. This will help you validate that the files are getting parsed for event boundaries and timestamps correctly and make it easier to apply your field extractions and other knowledge objects to the different types of data in the future.

I suggest using the data previewer which you can access from splunk web via "add data". This will let you set and validate event breaks, timestamp extraction etc. for each type of data and create the appropriate props.conf stanza for you. In the past, the log4j sourcetype has worked for similar apps for me, but I prefer to create sourcetypes for every distinct type of data.

raindrop18
Communicator

thanks, great idea. so the custom sourcetype should be configure on controller or can be on forwarder.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...