Splunk Search

What would be the best way to use index and source type for multiple projects?

casmond
New Member

Hi everyone,

I am new to Splunk and i have a quite a few projects in my organization. I know that an index can have more than one source type, which can be done by using roles and assigning to users. But, I'm not sure what would be the best way to use index and source type for my projects in Splunk.

Here are some ideas that i have for using index and source type. The first idea would be assigning the project name as index and products such as Windows and Linux for source type. For example: index= Project A, sourcetype=Windows, sourcetype=linux. Another idea would be assigning the products as index and project name for source type. For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

Thanks for your advice.
Casmond

0 Karma

inventsekar
Ultra Champion
  1. This above one is a good idea:
    Here are some ideas that i have for using index and sourcetype. The first idea would be assigning the project name as index and products such as Windows and linux for sourcetype.
    For example: index= Project A, sourcetype=Windows, sourcetype=linux.

    Another idea would be assigning the products as index and project name for sourcetype.
    For example Index=Windows, sourcetype=Project A, sourcetype=B and sourcetype=C.

  2. Also, for windows and linux, if you use add-ons / OS apps from splunkbase, the index/sourcetype will be automatically taken care.

  3. Also check the links by @hijacob .. that will give you superb ideas.

  4. For custom logs only we need to plan for index/sourcetype.

  5. For big splunk environments only we need to plan for index/sourcetype. For small/medium projects/environments, index/sourcetypes issues may rarely occur.

0 Karma

hijacob
Communicator
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...