I'm thinking about adding certain application server logs to our Splunk environment. At first, it seemed simple: I would make a file named "appsrv.log" be indexed as sourcetype "appsrv" (or something like that).
The problem is our test host contains several codelines/environments, which means it may have several different, but similarly named appsrv.log files. In a Splunk query, it may be difficult to distinguish which appsrv.log file the results come from unless the user looks at the path of the file itself in the search results. Given how long the path can be, this can be rather annoying.
I'm wondering if it would be better to give a different sourcetype to each codeline. For example: qa-appsrv, test-appsrv, dmo-appsrv.
Does this go against best practice? I'm wondering if anyone has any thoughts on this approach.
asked 05 Sep '11, 14:30
you may wish instead to create lookup tables against the path of the file, or add a custom indexed field indicating the environment. the lookup table approach is more flexible. basically, you create a CSV that maps the name/path of the file to the "codeline", using wildcard matches if necessary. The file would be something like:
and the transforms
if set as an automatic lookup, users will be able to search on the codeline, e.g., using
answered 05 Sep '11, 15:26