Splunk Search

Can splunk index same data into one index but different sourcetypes??

sivaranjiniG
Path Finder

Hello,

I have to index a log file in linux server in to one index but need to have two different sourcetype. Is it possible??

I tried but when compare 

index = audit_idx sourcetype = linux_audit and index =audit_idx sourcetype = linux_audit_mll , results are not same there are few logs missing in each.

Want to know why its happening.

Thanks in advance..

 

Tags (3)

isoutamo
SplunkTrust
SplunkTrust

Hi

you can use CLONE_SOURCETYPE to clone same event to the different sourcetype. You should remember that  it duplicates your license usage!

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...