Getting Data In

What is the best practice to write monitor stanzas for onboard Network logs from multiple hosts on server?

jarapally
Explorer

We have to onboard logs from more than 1200 network hosts which reside on a single server.
What is the best practice to write the monitor stanzas? Should we write stanza for each host or is there any other easy way to onboard?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Sounds like you have the network sources being collected onto a remote host where they are persisted by log files (like a syslog setup).

Therefore, how about one monitor stanza on the host that will search through the sub-directories. You can then use the configuration file settings like host_segment or host_regex to dynamically assign the true network source's hostname.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#MONITOR:

0 Karma

adonio
Ultra Champion

hello there,

take a look at this doc, hopefully you will find it helpful.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Specifyinputpathswithwildcards

0 Karma

jarapally
Explorer

There are more than 1200 IP's with different ranges. Writing a wildcard can be difficult. Any other way

0 Karma

adonio
Ultra Champion

when you say "network hosts" do you mean switches, routes, etc?

0 Karma

jarapally
Explorer

Yes exactly everything from network devices

0 Karma

adonio
Ultra Champion

i think syslog-ng or rsyslog is the easier solution.
leverage one of them to write the files to a nice structure and then use the monitor stanza with wild cards and host segment to assign the proper host name to each log

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...