We have to onboard logs from more than 1200 network hosts which reside on a single server.
What is the best practice to write the monitor stanzas? Should we write stanza for each host or is there any other easy way to onboard?
Sounds like you have the network sources being collected onto a remote host where they are persisted by log files (like a syslog setup).
Therefore, how about one monitor stanza on the host that will search through the sub-directories. You can then use the configuration file settings like host_segment
or host_regex
to dynamically assign the true network source's hostname.
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#MONITOR:
hello there,
take a look at this doc, hopefully you will find it helpful.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Specifyinputpathswithwildcards
There are more than 1200 IP's with different ranges. Writing a wildcard can be difficult. Any other way
when you say "network hosts" do you mean switches, routes, etc?
Yes exactly everything from network devices
i think syslog-ng or rsyslog is the easier solution.
leverage one of them to write the files to a nice structure and then use the monitor stanza with wild cards and host segment to assign the proper host name to each log