Getting Data In

sourcetype override

pmr
Explorer

I'm having issue overriding sourcetype thro props.conf. my config is on the inputs.conf on a forwarder i'm setting a generic sourcetype of network_device and then overriding that sourcetype on the indexer with props.conf, but it seems to be not working. here's my configs :

inputs.conf on forwarder :

[monitor:///opt/log]
host_segment = 3
sourcetype = network_device

props.conf on indexer :

[network_device]
TRANSFORMS-sourcetype_cisco_wap = cisco_wap_device

transforms.conf on indexer :

[cisco_wap_device]
DEST_KEY = MetaData:Sourcetype
REGEX = \:\s(%DOT11)-\d+-\S+
FORMAT = sourcetype::cisco_wap

The events are coming in all right and getting sourcetype'd as network_device, but its not source typing as cisco_wap. I've also tried using source:: but doesnt work either. I know am making something silly, but cant figure out. tried using splunk cmd btool --debug and it does show transform being used. but why isn't it getting sourcetyped as cisco_wap ?

Any help here will greatly help me.

thanks
pmr

Tags (1)
0 Karma

crt89
Communicator

Just want to say I did this process and I have managed to override the forwarder's sourcetype to my indexer. Thanks

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

If the forwarder is a Heavy (vs Light or Universal) forwarder, then the transforms (and the config files) must be on the forwarder rather than the indexer.

See here for details.

0 Karma

woodcock
Esteemed Legend

You did not show an example of your events. Without this we cannot validate your REGEX which is where these kinds of problems usually are (you think your REGEX is correct but it has a bug so that is the problem, not the way you've configured everything else).

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...