Knowledge Management

source type and event type

karakutu
Path Finder

I just want to know which filed name makes more sense to use for the segregation of the log type.

for example, we have Linux and windows logs. for separation of the log types in the report or alert which filed should be used. "source type" or "event type". and if you define it with a valid reason I would be very glad

thanks

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

In personally I see that sourcetype formalise the content/lexical format of event. If two event has the same format then they should have same sourcetype (unless there are some other reason to name those differently). 

Eventtype is more wider concept. Quite often (but not mandatory) it contains also sourcetype, but also e.g. index(es), host(s), source(s), tag(s) etc. Basically it groups together events which belongs to specific (business) event(s) or something other contexts. 

Both of those is really useful in correct context. In your case, it's impossible to say which one you are needing. Quite probably at least sourecetype, but probably also event types are needed/useful especially if you have several environments (dev, test, prod) where you could use one eventtype which content is different based on env (like macros).

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

In personally I see that sourcetype formalise the content/lexical format of event. If two event has the same format then they should have same sourcetype (unless there are some other reason to name those differently). 

Eventtype is more wider concept. Quite often (but not mandatory) it contains also sourcetype, but also e.g. index(es), host(s), source(s), tag(s) etc. Basically it groups together events which belongs to specific (business) event(s) or something other contexts. 

Both of those is really useful in correct context. In your case, it's impossible to say which one you are needing. Quite probably at least sourecetype, but probably also event types are needed/useful especially if you have several environments (dev, test, prod) where you could use one eventtype which content is different based on env (like macros).

r. Ismo

to4kawa
Ultra Champion

https://docs.splunk.com/Splexicon:Eventtype

https://docs.splunk.com/Splexicon:Sourcetype

For your purposes,  source type would be appropriate.

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...