checking the duplicate sourcetypes for monitor stanzas in UF

[kteng2024]

what happens if 2 different monitoring stanzas have same source type name ? . Is there any query to verify whether different monitoring stanzas having same source types and all this monitoring stanzas sending data to same index .

[gcusello]

Hi kteng2024
you can create a search index= your_index | stats count by sourcetype, source and see if there are different sources on the same sourcetype.

Otherwise you could use the bool command (see https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Usebtooltotroubleshootconfigurati... and http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/CommandlinetoolsforusewithSupport)

./splunk cmd btool inputs list --debug  > /tmp/inputsconfigs.txt 

Bye.
Giuseppe

[gcusello]

Hi kteng2024
you can create a search index= your_index | stats count by sourcetype, source and see if there are different sources on the same sourcetype.

Otherwise you could use the bool command (see https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Usebtooltotroubleshootconfigurati... and http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/CommandlinetoolsforusewithSupport)

./splunk cmd btool inputs list --debug  > /tmp/inputsconfigs.txt 

Bye.
Giuseppe

[pradeepkumarg · Accepted solution]

There is no issue if multiple monitors send the data to same sourcetype.
The difficulty will be defining in line breaking, time stamping and field extractions if those multiple monitors doesn't have the same logging format.

You can verify what different sources are sending data to a particular sourcetype,index by searching something like below

| tstats count WHERE sourcetype=my_sourcetype by source,index | stats values(source) values(index)