|
I have a stream (udp 518) of syslog coming in from two different syslog servers. I thought that I would be able to specify in inputs.conf like so: [udp://server1:518] sourcetype = syslog index = index1 connection_host = dns [udp://server2:518] sourcetype = syslog index = index2 connection_host = dns This is not working. If i comment out the second stanza, i can see syslog from server1 in index1, but nothing if both are uncommented. Any thoughts? |
One Answer:
|
Don't specify the server and you'll get the data from both. [udp://518] If <remote server=""> is empty - [udp://port] - the port will accept data sent from any server. Then here to specify the sourcetype etc... http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides |