Splunk Enterprise

How to setup 2 sourcetype for same source path in 2 hosts ?

georgear7
Path Finder

I have same source path in 2 different hosts and i want to setup 2 different source type for each server. how to do this ?

host: fela01u
source: /apps/test/*/stage/logs/*.log
sourcetype: fel_log

host: cola01u
source: /apps/test/*/stage/logs/*.log
sourcetype: col_log

When i search using source type 'col_log', it should give me the results of 'cola01u'.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When you create the inputs.conf files on each host, you can specify the sourcetype.  Then. the props.conf file on your indexers tells Splunk how to process the sourcetypes.

For example, on host fela01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = fel_log
index = foo

and on host cola01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = col_log
index = foo

Don't put those two stanzas into one file and put the one file on both hosts.  That will result in the stanzas being merged and only one sourcetype applied.

However, if these files contain similarly-structured data then they should use the same sourcetype.  Don't use sourcetype to distinguish where the data came from - that's what host and source are for.

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When you create the inputs.conf files on each host, you can specify the sourcetype.  Then. the props.conf file on your indexers tells Splunk how to process the sourcetypes.

For example, on host fela01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = fel_log
index = foo

and on host cola01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = col_log
index = foo

Don't put those two stanzas into one file and put the one file on both hosts.  That will result in the stanzas being merged and only one sourcetype applied.

However, if these files contain similarly-structured data then they should use the same sourcetype.  Don't use sourcetype to distinguish where the data came from - that's what host and source are for.

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

georgear7
Path Finder

@richgalloway This worked, thanks a lot.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!