Getting Data In

best sourcetype for tomcat logs

raindrop18
Communicator

I have 3 tomcat logs I want to push to splunk, and I would like to know which is the best source-type

[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=
[monitor:///opt/tomcat/logs/logback.log]
sourcetype=
[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=

Thanks,

Tags (2)
0 Karma

chanfoli
Builder

Firstly, your first and third monitor stanzas above appear to be the same. I don't know of any specific extractions for tomcat logs that are part of any built-in "pretrained" sourcetypes, with that, and because it is so simple to do, I would create your own sourcetypes for each distinct type of data. This will help you validate that the files are getting parsed for event boundaries and timestamps correctly and make it easier to apply your field extractions and other knowledge objects to the different types of data in the future.

I suggest using the data previewer which you can access from splunk web via "add data". This will let you set and validate event breaks, timestamp extraction etc. for each type of data and create the appropriate props.conf stanza for you. In the past, the log4j sourcetype has worked for similar apps for me, but I prefer to create sourcetypes for every distinct type of data.

raindrop18
Communicator

thanks, great idea. so the custom sourcetype should be configure on controller or can be on forwarder.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...