Splunk Search

checking the duplicate sourcetypes for monitor stanzas in UF

Path Finder

what happens if 2 different monitoring stanzas have same source type name ? . Is there any query to verify whether different monitoring stanzas having same source types and all this monitoring stanzas sending data to same index .

0 Karma
1 Solution

Influencer

There is no issue if multiple monitors send the data to same sourcetype.
The difficulty will be defining in line breaking, time stamping and field extractions if those multiple monitors doesn't have the same logging format.

You can verify what different sources are sending data to a particular sourcetype,index by searching something like below

| tstats count WHERE sourcetype=my_sourcetype by source,index | stats values(source) values(index) 

View solution in original post

SplunkTrust
SplunkTrust

Hi kteng2024
you can create a search index= your_index | stats count by sourcetype, source and see if there are different sources on the same sourcetype.

Otherwise you could use the bool command (see https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Usebtooltotroubleshootconfigurati... and http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/CommandlinetoolsforusewithSupport)

./splunk cmd btool inputs list --debug  > /tmp/inputsconfigs.txt 

Bye.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

Hi kteng2024
you can create a search index= your_index | stats count by sourcetype, source and see if there are different sources on the same sourcetype.

Otherwise you could use the bool command (see https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Usebtooltotroubleshootconfigurati... and http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/CommandlinetoolsforusewithSupport)

./splunk cmd btool inputs list --debug  > /tmp/inputsconfigs.txt 

Bye.
Giuseppe

0 Karma

Influencer

There is no issue if multiple monitors send the data to same sourcetype.
The difficulty will be defining in line breaking, time stamping and field extractions if those multiple monitors doesn't have the same logging format.

You can verify what different sources are sending data to a particular sourcetype,index by searching something like below

| tstats count WHERE sourcetype=my_sourcetype by source,index | stats values(source) values(index) 

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!