Getting Data In

Why is my sourcetype labeled with a "-1" or "-2" at the end of the name?

Simeon
Splunk Employee
Splunk Employee

I am indexing apache logs and have them rotating on a frequent basis. The log rotation will rename the file to error_log.1 and so forth...

I have noticed that some of my sourcetypes end up with a "-1" or "-2" at the end. For example, I have specified sourcetype=apache_error in my inputs.conf. However, I have noticed that I have some random "apache_error-2" and "apache_error-1" sourcetypes in my index. Why is this occurring?

My inputs.conf looks like this:

[source::.../var/log/httpd/error_log]
sourcetype = apache_error
Tags (3)
1 Solution

Simeon
Splunk Employee
Splunk Employee

In this scenario, there is the possibility that Splunk may try to index already rotated log files. This can especially occur if you have a forwarder that is turned off and the log file gets rotated multiple times. For this scenario, you can simply add a regex that recognizes the additional digit. Since Splunk performs a CRC check against the files indexed, it should not re-index old data. The proper inputs.conf stanza would look as follows:

[source::.../var/log/httpd/error_log(.\d+)?]
sourcetype = apache_error

View solution in original post

Simeon
Splunk Employee
Splunk Employee

In this scenario, there is the possibility that Splunk may try to index already rotated log files. This can especially occur if you have a forwarder that is turned off and the log file gets rotated multiple times. For this scenario, you can simply add a regex that recognizes the additional digit. Since Splunk performs a CRC check against the files indexed, it should not re-index old data. The proper inputs.conf stanza would look as follows:

[source::.../var/log/httpd/error_log(.\d+)?]
sourcetype = apache_error

amrit
Splunk Employee
Splunk Employee

you said inputs.conf in your original description - may wanna change that to props.conf 🙂

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...