Identifying multiple log streams on multiple hosts with the same paths (e.g. multiple JVM logs)

[aoates]

what options are available to make it clear to Splunk that particular log streams come from named environments and applications even if that information is

• not in the logs themselves
• not a function of hostname or IP (since 1 host may have multiple JVMs, each with multiple
• not distinguishable by source/filename since the set of log streams for an application will be identical to that same application across numerous distinct environments

[gkanapathy]

Assuming that you can identify the environment and application from a combination of host and source file path (I have to imagine that this is possible, since even without Splunk they would have to be able to figure this out), then you can just use a lookup table on the host and source (or a field that is extracted from a part of the source path). It's likely that there is some excel spreadsheet or table that already has this information that could be the basis for this lookup table.