I have one file that I need to pull two sourcetypes from. Here are the details: i created two independent inputs.conf files. inputs.conf [monitor:///var/log/audit/audit.log] index=sample sourcetype=sample1 inputs.conf [monitor:///var/log/audit/audit.log] index=sample sourcetype=sample2 My serverclass.conf file is set up with two stanzas: [serverClass:sample1] whitelist.0 = /var/opt/specific/to/sample1* machineTypesFilter = linux* restartSplunkd = true [serverClass:sample1:app:sample1] [serverClass:sample2] whitelist.0 = /var/opt/specific/to/sample2* machineTypesFilter = linux* restartSplunkd = true [serverClass:sample2:app:sample2] I am using the whitelist to identify key information within the log. The data is coming through with both whitelist details, but it is defaulting to only one sourcetype. My whitelist also contains host information which is also shared. The only thing that separates the sourcetypes is the /var/opt/specific/to/sample* details. I don't think host details matter, so I left these details in. Do I need to add an AND statement in there? [serverClass:sample1] whitelist.0 = /var/opt/specific/to/sample1* AND whitelist.1 = host machineTypesFilter = linux* restartSplunkd = true [serverClass:sample1:app:sample1] Or is there something else that i should consider? Thanks, Jennifer ... View more

We need to create a report that lists all devices and servers reporting into Splunk. We want to have the report broken out by country. We don't have an internal cross-reference to identify servers to countries. I was using this search based on other Answer questions. index=_internal source="/opt/splunk/var/log/splunk/metrics.log*" sourcetype="splunkd" fwdType="*" | dedup sourceHost|stats count by hostname, sourceHost, fwdType, guid, os, arch I tried to plug in the geoip/iplocation searches to see if we could obtain the location of our servers. I wasn't able to get results. Please advise if you have suggestions. Thanks! Jenn ... View more