Splunk Search

What is the best way categorize environments for different sets of IIS logs to improve organization and efficient searching?

mjesudasan
New Member

Hi,

My question is regarding indexing IIS logs. We have about 50 websites on a single server. 4 websites make up 1 environment, I am trying to find the best way to keeps the logs organized so it's easy to search per environment.

I tried to divide the websites by sourcetype, but I don't think that's the best approach as it will get confusing when we have 15 environments. Am I able to create a new field, set in the inputs.conf, for example env=master and all the 4 websites that make up the 'master' environment will fall under the search env="master"?

Thanks,
Milan

0 Karma
1 Solution

woodcock
Esteemed Legend

This is what tags and eventtypes are for. You should create global tags in tags.conf like this:

[host=123.45.78.90]
Dallas=enabled
master=enabled

Then you can search like this:

tag=master

http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Defineandusetags

View solution in original post

0 Karma

woodcock
Esteemed Legend

This is what tags and eventtypes are for. You should create global tags in tags.conf like this:

[host=123.45.78.90]
Dallas=enabled
master=enabled

Then you can search like this:

tag=master

http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Defineandusetags

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...