Getting Data In

How to monitor the same log location from different servers with different source names?

aak2
New Member

Hi,

I have the same log file locations with same file names in 3 different VMs. I want to differentiate them with source name in the same index and sourcetype. Here is my inputs.conf stanza:

[monitor:///data02/logs/ConnectionServer/logs/ConnectionServer.log]
sourcetype=jboss_server
source=app_prod_node1
index=prod_app
ignoreOlderThan=1d
0 Karma

lguinn2
Legend

That is not the best way to do this. Let the source default to the file name. Set the host to the hostname of the VM. Differentiate using the the host name, not the source name.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...