Splunk Search

Identifying multiple log streams on multiple hosts with the same paths (e.g. multiple JVM logs)

aoates
Splunk Employee
Splunk Employee

what options are available to make it clear to Splunk that particular log streams come from named environments and applications even if that information is

  • not in the logs themselves
  • not a function of hostname or IP (since 1 host may have multiple JVMs, each with multiple
  • not distinguishable by source/filename since the set of log streams for an application will be identical to that same application across numerous distinct environments
Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

Assuming that you can identify the environment and application from a combination of host and source file path (I have to imagine that this is possible, since even without Splunk they would have to be able to figure this out), then you can just use a lookup table on the host and source (or a field that is extracted from a part of the source path). It's likely that there is some excel spreadsheet or table that already has this information that could be the basis for this lookup table.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...