what happens if 2 different monitoring stanzas have same source type name ? . Is there any query to verify whether different monitoring stanzas having same source types and all this monitoring stanzas sending data to same index .
There is no issue if multiple monitors send the data to same sourcetype.
The difficulty will be defining in line breaking, time stamping and field extractions if those multiple monitors doesn't have the same logging format.
You can verify what different sources are sending data to a particular sourcetype,index by searching something like below
| tstats count WHERE sourcetype=my_sourcetype by source,index | stats values(source) values(index)
Hi kteng2024
you can create a search index= your_index | stats count by sourcetype, source
and see if there are different sources on the same sourcetype.
Otherwise you could use the bool command (see https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Usebtooltotroubleshootconfigurati... and http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/CommandlinetoolsforusewithSupport)
./splunk cmd btool inputs list --debug > /tmp/inputsconfigs.txt
Bye.
Giuseppe
Hi kteng2024
you can create a search index= your_index | stats count by sourcetype, source
and see if there are different sources on the same sourcetype.
Otherwise you could use the bool command (see https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Usebtooltotroubleshootconfigurati... and http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/CommandlinetoolsforusewithSupport)
./splunk cmd btool inputs list --debug > /tmp/inputsconfigs.txt
Bye.
Giuseppe
There is no issue if multiple monitors send the data to same sourcetype.
The difficulty will be defining in line breaking, time stamping and field extractions if those multiple monitors doesn't have the same logging format.
You can verify what different sources are sending data to a particular sourcetype,index by searching something like below
| tstats count WHERE sourcetype=my_sourcetype by source,index | stats values(source) values(index)