What would be the best way to use index and source type for multiple projects?

[casmond]

Hi everyone,

I am new to Splunk and i have a quite a few projects in my organization. I know that an index can have more than one source type, which can be done by using roles and assigning to users. But, I'm not sure what would be the best way to use index and source type for my projects in Splunk.

Here are some ideas that i have for using index and source type. The first idea would be assigning the project name as index and products such as Windows and Linux for source type. For example: index= Project A, sourcetype=Windows, sourcetype=linux. Another idea would be assigning the products as index and project name for source type. For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

Thanks for your advice.
Casmond

[inventsekar]

1. This above one is a good idea:
   Here are some ideas that i have for using index and sourcetype. The first idea would be assigning the project name as index and products such as Windows and linux for sourcetype.
   For example: index= Project A, sourcetype=Windows, sourcetype=linux.
   
   Another idea would be assigning the products as index and project name for sourcetype.
   For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

2. Also, for windows and linux, if you use add-ons / OS apps from splunkbase, the index/sourcetype will be automatically taken care.

3. Also check the links by @hijacob .. that will give you superb ideas.

4. For custom logs only we need to plan for index/sourcetype.

5. For big splunk environments only we need to plan for index/sourcetype. For small/medium projects/environments, index/sourcetypes issues may rarely occur.

[hijacob]

Hi,

please have a look at the docs http://docs.splunk.com/Documentation/Splunk/7.2.1/Indexer/Setupmultipleindexes and http://docs.splunk.com/Documentation/Splunk/7.2.1/Data/Createsourcetypes

Greetings,
Jacob