In my app, I want Syslog from two different sources in two different sourcetypes (since they both are of different types). I have two options for this:
- enable two ports and assign different sourcetypes to both
- collect them on single port and assign different sourcetypes using regex (will require much analysis of logs)
What is the recommended approach ?
Thanks,
Kashyap
The best practice approach for syslog collection is to send your log data to a syslog server, apply proper policies in syslog server to write to separate files/folder and use a Universal Forwarder on the syslog server to process the log files the splunky way.
Note that if you send syslog to a Splunk listener, you will lose data every time you have to restart Splunk, e.g. to apply configuration changes. Plus, as you are just finding out, you have to have a separate port for each sourcetype, which gets messy quickly.
Always use distinct (in this case 2) ports. Then you can debug problems from the outside using OS tools, too.
If you are stuck using a single port then you should use this project and help contribute to the auto-sourcetypeing RegEx list:
https://github.com/splunk/splunk-connect-for-syslog/wiki
The best practice approach for syslog collection is to send your log data to a syslog server, apply proper policies in syslog server to write to separate files/folder and use a Universal Forwarder on the syslog server to process the log files the splunky way.
Note that if you send syslog to a Splunk listener, you will lose data every time you have to restart Splunk, e.g. to apply configuration changes. Plus, as you are just finding out, you have to have a separate port for each sourcetype, which gets messy quickly.
Hi kashyap2702,
if you can I'd prefer the first.
Bye.
Giuseppe