Manage Existing Log Sources

You can use the Log Sources page to edit existing log sources and add entity associations to existing log sources.

You can enable existing log sources by associating entities to them. See Associate Entities to Existing Log Sources.

Edit Log Source

Modify the existing log source to customize it for your use case, but ensure that you consider the dependencies such as data filters, labels, extended fields, and other parser dependencies when you edit.

1. From Oracle Log Analytics, click the OMC Navigation () icon on the top left corner of the interface. In the OMC Navigation bar, click Administration Home.

2. In the Log Sources section, click the available count of log sources link.

3. Click Open Menu () next to the log source entry that you want to edit and select Edit.

   The Edit Log Source page is displayed.

4. Modify the log source definition and click Save.

Override Out-of-the-Box parsers

In an out-of-the-box log source, the default file parsers are already specified. If you want to override the out-of-the-box parsers used or change the order in which the parsers are applied on the logs, then follow these steps:

1. Under File Parser > Specific Parsers > click Custom > click the Select Parsers area.

2. Type a few characters from the name of the parser to get the list of suggestions. Select the parser.

   Repeat the selection process to include multiple parsers. You can also include parsers that you've created for this customization. Ensure to specify the parsers in the same order in which they must be applied on the logs.

Follow the above steps to customize the log source if your log files are slightly different. Otherwise, create a new log source.

Important: Ensure that the new parsers that you selected have the same output fields as the old parsers because of the data enrichment dependency.

Create a Log Source Based on an Existing One

If you’re not sure about how to create a log source, then you can use any existing log source to create a new one.

1. From Oracle Log Analytics, click the OMC Navigation () icon on the top left corner of the interface. In the OMC Navigation bar, click Administration Home.
2. In the Log Sources section, click the available count of log sources link.
3. Click Open Menu () next to the log source entry based on which you want to create a new log source and select Create Like.
   The Create Log Source page is displayed with the log definition fields populated with the definitions of the existing log source.
4. Modify the log source definition and click Save.