Hello,
I added a transform/props for my Juniper SRX firewall logs to get sourcetyped as juniper_sa. Worked right out of the gate. BUT when I search by that source type I get no results. How ever clear as day I can see that source type on the logs
Another way of saying it is this:
as search of "index=firewall" returns events which clear as day have source type "juniper_sa" on them
a search of "index=firewall sourcetype=juniper_sa" returns no results.
I tried adding the transforms/props to my search head as well as intermediate servers. Didn't seem to matter. Same problem.
Any ideas?
The sourcetype=juniper_sa
that is in your log text will not override the sourcetype=blah
that Splunk will assign to your events unless you configure Splunk to do so. When you search in "Verbose" mode and click on the "All fields" hyperlink, what values does sourcetype
have? I am quite sure it will not be juniper_sa
. In any case, you need to provide your inputs.conf
, props.conf
, and transforms.conf
if you would like more specific help.