Splunk Enterprise

How to write 5000 NE source details in inputs.conf

Path Finder

Hi all,

I want to integrate 5000 network elements into splunk via syslog. So, 5000 directories will be created where the data is collected respectively. Could anyone suggest me how to write inputs.conf to monitor all these 5000 directories.


Its quite difficult to write 5000 stanzas. Looking for a simplied solution. Please help

Labels (2)
0 Karma


You probably don't want all 5,000 entries on a single syslog server.  Use more than one to spread the load and risk.

Writing 5,000 stanzas isn't difficult, it's just tedious and time-consuming.  Consider creating a script to do it for you.

Depending on how you name the directories, it could be possible to use patterns to reduce the number of stanzas needed.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...