I am looking for some help in managing apps using deployment server. Here is the case.
I have two different apps, sending two different logs from same set of servers. The index and sourcetype are the same. They use the same server class.
**App 1:**
monitor://G:\Logfiles\subdir1\*.log
monitor://G:\Logfiles\subdir2\*.log
**App2**
monitor://G:\Logfiles\subdir3\*.log
monitor://G:\Logfiles\subdir4\*.log
Now I have a new requirement to send the all the logs from all the sub directories. There are close to 250 sub directories
monitor://G:\Logfiles\*\*.log
How to do I achieve this.
• Should I disable App1 and App2, create new app to monitor://G:\Logfiles\*\*.log. if yes, how to disable app
• Should I delete App1 and App2, create new app to monitor://G:\Logfiles\*\*.log
• Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log. Will this cause events duplicating
• Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log excluding the subdir1, subdir2, subdir3 and subdir4
Any other ways of doing this.
↧