Splunk Search

What would be the best way to use index and source type for multiple projects?

casmond
New Member

Hi everyone,

I am new to Splunk and i have a quite a few projects in my organization. I know that an index can have more than one source type, which can be done by using roles and assigning to users. But, I'm not sure what would be the best way to use index and source type for my projects in Splunk.

Here are some ideas that i have for using index and source type. The first idea would be assigning the project name as index and products such as Windows and Linux for source type. For example: index= Project A, sourcetype=Windows, sourcetype=linux. Another idea would be assigning the products as index and project name for source type. For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

Thanks for your advice.
Casmond

0 Karma

inventsekar
SplunkTrust
SplunkTrust
  1. This above one is a good idea:
    Here are some ideas that i have for using index and sourcetype. The first idea would be assigning the project name as index and products such as Windows and linux for sourcetype.
    For example: index= Project A, sourcetype=Windows, sourcetype=linux.

    Another idea would be assigning the products as index and project name for sourcetype.
    For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

  2. Also, for windows and linux, if you use add-ons / OS apps from splunkbase, the index/sourcetype will be automatically taken care.

  3. Also check the links by @hijacob .. that will give you superb ideas.

  4. For custom logs only we need to plan for index/sourcetype.

  5. For big splunk environments only we need to plan for index/sourcetype. For small/medium projects/environments, index/sourcetypes issues may rarely occur.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

hijacob
Communicator
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...