Splunk Enterprise

How to write 5000 NE source details in inputs.conf

yamini_37
Path Finder

Hi all,

I want to integrate 5000 network elements into splunk via syslog. So, 5000 directories will be created where the data is collected respectively. Could anyone suggest me how to write inputs.conf to monitor all these 5000 directories.

 

Its quite difficult to write 5000 stanzas. Looking for a simplied solution. Please help

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You probably don't want all 5,000 entries on a single syslog server.  Use more than one to spread the load and risk.

Writing 5,000 stanzas isn't difficult, it's just tedious and time-consuming.  Consider creating a script to do it for you.

Depending on how you name the directories, it could be possible to use patterns to reduce the number of stanzas needed.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...