How to write 5000 NE source details in inputs.conf

[yamini_37]

Hi all,

I want to integrate 5000 network elements into splunk via syslog. So, 5000 directories will be created where the data is collected respectively. Could anyone suggest me how to write inputs.conf to monitor all these 5000 directories.

Its quite difficult to write 5000 stanzas. Looking for a simplied solution. Please help

[richgalloway]

You probably don't want all 5,000 entries on a single syslog server.  Use more than one to spread the load and risk.

Writing 5,000 stanzas isn't difficult, it's just tedious and time-consuming.  Consider creating a script to do it for you.

Depending on how you name the directories, it could be possible to use patterns to reduce the number of stanzas needed.