Getting Data In

How to index logs of different source types in a single index?

masterpiece
Engager

How can I index logs from different source types in the same index?
Let's say Network ABC is having one AD and one Firewall. Now I want to create an index ABC and want to index logs from both different hosts in ABC instead of two different indexesfor each host.

0 Karma
1 Solution

ddrillic
Ultra Champion

That's the idea - to have an index with multiple sourcetypes ; -)

A bit more complex situation ...

How to index a single data source and apply multiple sourcetypes based on the format of the log line...

For example -

[monitor:///var/log/app/\w+.log*] 
sourcetype = log4j 
index = main

[monitor:///var/log/app/\w+-(web|req).log*]
sourcetype = access_common
index = main

[monitor:///var/log/app/\w+-billing.log*]
sourcetype = custom_billing
index = billing

It's from how to assign index and sourcetype to multiple different file types that live in the same directory

View solution in original post

ddrillic
Ultra Champion

That's the idea - to have an index with multiple sourcetypes ; -)

A bit more complex situation ...

How to index a single data source and apply multiple sourcetypes based on the format of the log line...

For example -

[monitor:///var/log/app/\w+.log*] 
sourcetype = log4j 
index = main

[monitor:///var/log/app/\w+-(web|req).log*]
sourcetype = access_common
index = main

[monitor:///var/log/app/\w+-billing.log*]
sourcetype = custom_billing
index = billing

It's from how to assign index and sourcetype to multiple different file types that live in the same directory

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...