Splunk Search

What is the best way categorize environments for different sets of IIS logs to improve organization and efficient searching?

New Member

Hi,

My question is regarding indexing IIS logs. We have about 50 websites on a single server. 4 websites make up 1 environment, I am trying to find the best way to keeps the logs organized so it's easy to search per environment.

I tried to divide the websites by sourcetype, but I don't think that's the best approach as it will get confusing when we have 15 environments. Am I able to create a new field, set in the inputs.conf, for example env=master and all the 4 websites that make up the 'master' environment will fall under the search env="master"?

Thanks,
Milan

0 Karma
1 Solution

Esteemed Legend

This is what tags and eventtypes are for. You should create global tags in tags.conf like this:

[host=123.45.78.90]
Dallas=enabled
master=enabled

Then you can search like this:

tag=master

http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Defineandusetags

View solution in original post

0 Karma

Esteemed Legend

This is what tags and eventtypes are for. You should create global tags in tags.conf like this:

[host=123.45.78.90]
Dallas=enabled
master=enabled

Then you can search like this:

tag=master

http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Defineandusetags

View solution in original post

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!