How to index log file from 50 servers

[k_harini]

Hi,
There are around 50 servers for which log files are in same format... I want to track current server status, number of servers up/down at particular time and corresponding drill down etc. In the servers, log files will be in xxx.log format. Now my question is how to index these? Like having 50 different folders to monitor these with server name as source type? Or is there any other better option? Files will be picked up by using forwarders from the servers.

Please provide suggestions. Thanks

[adonio · Accepted solution]

Hello k_harini,
monitor the folder is a good option when using the Universal Forwarder.
have all logs (if they are the same sourcetype) as same sourcetype, Splunk will extract the host field automatically by forwarder so you can always know where the particular event came from.
something like this on the forwarders on 50 servers:

[monitor://full/path/to/log/*.log]
sourcetype = uniqueSourcetype
index = dataIndex

hope it helps