Getting Data In

best sourcetype for tomcat logs

raindrop18
Communicator

I have 3 tomcat logs I want to push to splunk, and I would like to know which is the best source-type

[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=
[monitor:///opt/tomcat/logs/logback.log]
sourcetype=
[monitor:///opt/tomcat/logs/transactions.log]
sourcetype=

Thanks,

Tags (2)
0 Karma

chanfoli
Builder

Firstly, your first and third monitor stanzas above appear to be the same. I don't know of any specific extractions for tomcat logs that are part of any built-in "pretrained" sourcetypes, with that, and because it is so simple to do, I would create your own sourcetypes for each distinct type of data. This will help you validate that the files are getting parsed for event boundaries and timestamps correctly and make it easier to apply your field extractions and other knowledge objects to the different types of data in the future.

I suggest using the data previewer which you can access from splunk web via "add data". This will let you set and validate event breaks, timestamp extraction etc. for each type of data and create the appropriate props.conf stanza for you. In the past, the log4j sourcetype has worked for similar apps for me, but I prefer to create sourcetypes for every distinct type of data.

raindrop18
Communicator

thanks, great idea. so the custom sourcetype should be configure on controller or can be on forwarder.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...