Getting Data In

best sourcetype for tomcat logs

raindrop18
Communicator

I have 3 tomcat logs I want to push to splunk, and I would like to know which is the best source-type

[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=
[monitor:///opt/tomcat/logs/logback.log]
sourcetype=
[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=

Thanks,

Tags (2)
0 Karma

chanfoli
Builder

Firstly, your first and third monitor stanzas above appear to be the same. I don't know of any specific extractions for tomcat logs that are part of any built-in "pretrained" sourcetypes, with that, and because it is so simple to do, I would create your own sourcetypes for each distinct type of data. This will help you validate that the files are getting parsed for event boundaries and timestamps correctly and make it easier to apply your field extractions and other knowledge objects to the different types of data in the future.

I suggest using the data previewer which you can access from splunk web via "add data". This will let you set and validate event breaks, timestamp extraction etc. for each type of data and create the appropriate props.conf stanza for you. In the past, the log4j sourcetype has worked for similar apps for me, but I prefer to create sourcetypes for every distinct type of data.

raindrop18
Communicator

thanks, great idea. so the custom sourcetype should be configure on controller or can be on forwarder.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...