Getting Data In

configure sourcetype to an application

abovebeyond
Communicator

Hello,

one of our application has the following log structure

#Fields: Date ; Time ; Site Instance ; Event ; Client IP ; Username ; Host header ; Additional info about request (event specific)

how can i add it as sourcetype to splunk ?

Thanks

Tags (2)
0 Karma

dineshraj
Explorer

Add below code to your transforms.conf -

[mytestsourcetype]
DELIMS = ";"
FIELDS = "Date", "Time", "Site Instance"....
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You add it as an input. One of the configuration options is to set the sourcetype.

http://www.splunk.com/base/Documentation/6.2.4/Admin/Inputsconf?r=splunky

[monitor:///myfile/....]
sourcetype = my_sourcetype

After you have it in Splunk, you can create the extractions for it to pull the interesting fields.

abovebeyond
Communicator

Hey

already got the logs on splunk by using :

[monitor://D:\LogFiles\ApplicationLogs\logtest_*]
disabled = 0
recursive = true
index = logtest
sourcetype = mytestsourcerype

BUT, i cant filter by fields , splunk doesnt recognize the logs with the fields

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

So know you need to setup Field Extractions. Check this out in the manual: http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/ExtractfieldsinteractivelywithIFX There are few different ways to extract the data, but this will get you started.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...