Splunk Enterprise

How to write 5000 NE source details in inputs.conf

yamini_37
Path Finder

Hi all,

I want to integrate 5000 network elements into splunk via syslog. So, 5000 directories will be created where the data is collected respectively. Could anyone suggest me how to write inputs.conf to monitor all these 5000 directories.

 

Its quite difficult to write 5000 stanzas. Looking for a simplied solution. Please help

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You probably don't want all 5,000 entries on a single syslog server.  Use more than one to spread the load and risk.

Writing 5,000 stanzas isn't difficult, it's just tedious and time-consuming.  Consider creating a script to do it for you.

Depending on how you name the directories, it could be possible to use patterns to reduce the number of stanzas needed.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...