Splunk Base : SplunkAdministration : #3417

Multiple Directories having the same SourceType

anon1m0us — Wed, 14 Oct 2009 07:53:38 PDT

Thanks!
The docs only mentioned Subdirectories, so I was a little worried about different directories.

araitz — Wed, 14 Oct 2009 07:43:28 PDT

Sure, that will work fine. The point of sourcetypes is to span across multiple sources.

anon1m0us — Wed, 14 Oct 2009 06:47:28 PDT

Can I have multiple directories using the same sourcetype?

We have application logs that are split into two locations. I want to have one sourcetype to access them both.

For Example:
[monitor:D:\Application\Logs\OldLogs]
sourcetype = appslogs
disabled = false
index=commonapps

[monitor:C:\Application\Logs\CurrentLogs]
sourcetype = applogs
disabled = false
index=commonapps

Any better ways of doing it?