What is the best way categorize environments for different sets of IIS logs to improve organization and efficient searching?

[mjesudasan]

Hi,

My question is regarding indexing IIS logs. We have about 50 websites on a single server. 4 websites make up 1 environment, I am trying to find the best way to keeps the logs organized so it's easy to search per environment.

I tried to divide the websites by sourcetype, but I don't think that's the best approach as it will get confusing when we have 15 environments. Am I able to create a new field, set in the inputs.conf, for example env=master and all the 4 websites that make up the 'master' environment will fall under the search env="master"?

Thanks,
Milan

[woodcock · Accepted solution]

This is what tags and eventtypes are for. You should create global tags in tags.conf like this:

[host=123.45.78.90]
Dallas=enabled
master=enabled

Then you can search like this:

tag=master

http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Defineandusetags