Splunk Enterprise

How to setup 2 sourcetype for same source path in 2 hosts ?

georgear7
Communicator

I have same source path in 2 different hosts and i want to setup 2 different source type for each server. how to do this ?

host: fela01u
source: /apps/test/*/stage/logs/*.log
sourcetype: fel_log

host: cola01u
source: /apps/test/*/stage/logs/*.log
sourcetype: col_log

When i search using source type 'col_log', it should give me the results of 'cola01u'.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When you create the inputs.conf files on each host, you can specify the sourcetype.  Then. the props.conf file on your indexers tells Splunk how to process the sourcetypes.

For example, on host fela01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = fel_log
index = foo

and on host cola01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = col_log
index = foo

Don't put those two stanzas into one file and put the one file on both hosts.  That will result in the stanzas being merged and only one sourcetype applied.

However, if these files contain similarly-structured data then they should use the same sourcetype.  Don't use sourcetype to distinguish where the data came from - that's what host and source are for.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When you create the inputs.conf files on each host, you can specify the sourcetype.  Then. the props.conf file on your indexers tells Splunk how to process the sourcetypes.

For example, on host fela01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = fel_log
index = foo

and on host cola01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = col_log
index = foo

Don't put those two stanzas into one file and put the one file on both hosts.  That will result in the stanzas being merged and only one sourcetype applied.

However, if these files contain similarly-structured data then they should use the same sourcetype.  Don't use sourcetype to distinguish where the data came from - that's what host and source are for.

 

---
If this reply helps you, Karma would be appreciated.

georgear7
Communicator

@richgalloway This worked, thanks a lot.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...