Hi @orendado , you can tag your data using tags and eventtypes (https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/Abouteventtypes) but maintaining the sourcetype of each data source...
See more...
Hi @orendado , you can tag your data using tags and eventtypes (https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/Abouteventtypes) but maintaining the sourcetype of each data source, in this way you have all the parsing rules up and running. I usually define a sorcetype for each type of data, eventually cloning an existing one: e.g. if I have a custom data source in csv format, I'll clone it from the standard csv and I call it "my_sourcetype" (or the name you like). In this way I have all the parsing rules of the csv, eventually adding other specific, and I recognize those logs also by sourcetype. Remember that this is useful only for custom data sources, if you have standard data sources (e.g. Fortinet or Cisco or Checkpoint), it's always better to use the sourcetypes in the add-ons from Splunkbase. This is relevant also because it isn't sufficient to parse the data, but it's also important to normalize data to use them in apps as Enterprise Security. In addition, in these add-ons tags and eventtypes are already defined. Ciao. Giuseppe