sourcetype naming scheme

[paranoid]

What's a good sourcetype naming scheme in a large environment with numerous different applications using several technologies. eg. web-site for Antartica using apache, redis server used by mobile-site for Greenland... I am thinking of sourcetypes like:

www:aq:access
mobile:gl:redis

This will allow queries with: sourcetype=*:*:redis to search all redis logs or sourcetype=www:*:access to count combined web traffic and it will still allow searching just the web traffic for Antartica.

Or should I leave sourcetypes as:

sourcetype=access
sourcetype=redis

and then use eventtypes to achieve the above granularity?

I tend to prefer the granularity in the sourcetype because then we categorize the data at the source. With eventtypes all the configuration is taking place on the indexers and possible burning some CPU there as well.

Thoughts?

[sowings]

I personally feel that two levels of subcategories is probably overkill. I've seen several installations that make use of a single level, such as www:apache, www:iis or something like that. If further subdivision within those types is required, I've seen a _ as the secondary separator: www:apache_error www:apache_access. It is, of course, up to you. The ability to make use of a wildcard within a high-level type to find all matching types of data is a good trick.

You might also consider reading up on the "Common Information Model" here to give yourself a leg up on field naming schemes as well.

[lguinn2]

Update for the Common Information Model link.