Splunk Search

What would be the best way to use index and source type for multiple projects?

casmond
New Member

Hi everyone,

I am new to Splunk and i have a quite a few projects in my organization. I know that an index can have more than one source type, which can be done by using roles and assigning to users. But, I'm not sure what would be the best way to use index and source type for my projects in Splunk.

Here are some ideas that i have for using index and source type. The first idea would be assigning the project name as index and products such as Windows and Linux for source type. For example: index= Project A, sourcetype=Windows, sourcetype=linux. Another idea would be assigning the products as index and project name for source type. For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

Thanks for your advice.
Casmond

0 Karma

inventsekar
SplunkTrust
SplunkTrust
  1. This above one is a good idea:
    Here are some ideas that i have for using index and sourcetype. The first idea would be assigning the project name as index and products such as Windows and linux for sourcetype.
    For example: index= Project A, sourcetype=Windows, sourcetype=linux.

    Another idea would be assigning the products as index and project name for sourcetype.
    For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

  2. Also, for windows and linux, if you use add-ons / OS apps from splunkbase, the index/sourcetype will be automatically taken care.

  3. Also check the links by @hijacob .. that will give you superb ideas.

  4. For custom logs only we need to plan for index/sourcetype.

  5. For big splunk environments only we need to plan for index/sourcetype. For small/medium projects/environments, index/sourcetypes issues may rarely occur.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

hijacob
Communicator
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...