Splunk Search

What would be the best way to use index and source type for multiple projects?

casmond
New Member

Hi everyone,

I am new to Splunk and i have a quite a few projects in my organization. I know that an index can have more than one source type, which can be done by using roles and assigning to users. But, I'm not sure what would be the best way to use index and source type for my projects in Splunk.

Here are some ideas that i have for using index and source type. The first idea would be assigning the project name as index and products such as Windows and Linux for source type. For example: index= Project A, sourcetype=Windows, sourcetype=linux. Another idea would be assigning the products as index and project name for source type. For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

Thanks for your advice.
Casmond

0 Karma

inventsekar
SplunkTrust
SplunkTrust
  1. This above one is a good idea:
    Here are some ideas that i have for using index and sourcetype. The first idea would be assigning the project name as index and products such as Windows and linux for sourcetype.
    For example: index= Project A, sourcetype=Windows, sourcetype=linux.

    Another idea would be assigning the products as index and project name for sourcetype.
    For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

  2. Also, for windows and linux, if you use add-ons / OS apps from splunkbase, the index/sourcetype will be automatically taken care.

  3. Also check the links by @hijacob .. that will give you superb ideas.

  4. For custom logs only we need to plan for index/sourcetype.

  5. For big splunk environments only we need to plan for index/sourcetype. For small/medium projects/environments, index/sourcetypes issues may rarely occur.

0 Karma

hijacob
Communicator
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...