All Apps and Add-ons

How to format or assign sourcetype for mongod.log

dhavamanis
Builder

We installed Splunk universal forwarder in mongodb host and started getting logs in Splunk. Can you please let us know how to assign the sourcetype to extract fields for "MongoDB Monitoring" app required format. Also please tell us how to assign specific index for this app, because we are sending all mongod.log to one common index.

Tags (1)
0 Karma
1 Solution

maciep
Champion

Not sure if you need much more than this, but the documentation for the app is on git hub. It says that extractions are based on the mongod sourcetype. And by default, the dashboards search for events in the mongodb index. But you can put them in any index you want and just update the search macros accordingly.

https://github.com/jruaux/mongodb-monitoring#mongodb-logs

Does that help?

View solution in original post

maciep
Champion

Not sure if you need much more than this, but the documentation for the app is on git hub. It says that extractions are based on the mongod sourcetype. And by default, the dashboards search for events in the mongodb index. But you can put them in any index you want and just update the search macros accordingly.

https://github.com/jruaux/mongodb-monitoring#mongodb-logs

Does that help?

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...