Getting Data In

Add a tag (i.e.: environment) to events on a server class.

gmjunior
Engager

I have multiple environments (QA, PreProd, Prod) sending data to splunk, and I'm using deployment server to manage all forwarders.
I'm thinking of creating an "app" called Linux, that will "configure" or "add" the input I want to monitor for that specific kind app (i.e: Linux), but I want to separate the data into different indexes (or tag them in some way) by environment but I didn't realize how can I do that, if possible.

Ex:
/etc/deployment-apps/linux/local/inputs:
[monitor:///var/log/messages]
disabled = false
sourcetype = linux_messages_syslog
[monitor:///var/log/secure]
disabled = false
sourcetype = linux_secure

Then I would want to tie this app to various server-class. Something like:
LinuxProd, LinuxQA, etc.
And for that tie, I want to set the index. LinuxQA will have the same inputs as LinuxProd but different indexes.

I know I can achieve that by creating different apps with, something like this:

Ex:
/etc/deployment-apps/linux_qa/local/inputs:
[monitor:///var/log/messages]
disabled = false
sourcetype = linux_messages_syslog
index = linux_qa

[monitor:///var/log/secure]
disabled = false
sourcetype = linux_secure
index = linux_qa

And /etc/deployment-apps/linux_prod/local/inputs:

[monitor:///var/log/messages]
disabled = false
sourcetype = linux_messages_syslog
index = linux_prod

[monitor:///var/log/secure]
disabled = false
sourcetype = linux_secure
index = linux_prod

But that doesn't feel right. Any help would be really appreciated.
Thanks

gmjunior
Engager

Thank you for your comment Martin, but that's not the best option for me, I would have to create 4 new environments, I have 3 acceptance environments (qa) plus preprod. Prod is already separated, but I don't need more granularity then that.

Any other options?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'd recommend setting up separate splunk environments for qa and prod that each have an index called linux. Then you can use one without affecting the other and reuse your apps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...