Getting Data In

Why props.conf configurations not taking effect?

ankireddy007
Path Finder

Hi,

I am receiving syslog data from various type of devices, but all are on udp:514. I need to overwrite the sourcetype based on Host IP address. Following are the configurations I did, but this is not taking effective. My search result shows sourcetype as [syslog] only.
Can you please help me where I am doing the mistake.

Configurations made in $SPLUNK_HOME/etc/system/local directory

    inputs.conf
        [udp://514]
        connection_host = ip
        source = udp_514
        sourcetype = syslog

    props.conf
        [host::10\.0\.6\.23]
        sourcetype = websense

        [host::10\.0\.6\.113]
        sourcetype = cisco:ios
0 Karma
1 Solution

strive
Influencer

This link will help you

http://answers.splunk.com/answers/3687/host-stanza-in-propsconf-not-being-honored-for-udp514-data-so...

You set the sourcetype in transforms.conf and then use that in props.conf file

View solution in original post

strive
Influencer

This link will help you

http://answers.splunk.com/answers/3687/host-stanza-in-propsconf-not-being-honored-for-udp514-data-so...

You set the sourcetype in transforms.conf and then use that in props.conf file

strive
Influencer

Check the sourcetype configuration section in http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf

0 Karma

ankireddy007
Path Finder

Thaks Strive, Its working.
But any idea why settings in props.conf alone (without transforms.conf) not working.

0 Karma

ankireddy007
Path Finder

HI Strive,

Here no forwarders in this deployment, as all syslog devices sending data on udp:514. I have splunk indexer acting as syslog server to receive on udp:514.
All configurations made in Splunk INDEXER. (system/local directory)
Yes I am seeing different hosts (IPs) on search

Thansk, Anki

0 Karma

strive
Influencer

Where do you have your props.conf? Is it on forwarder or indexer? what type of forwarder are you using? In your search results are you seeing different IP addresses as hosts?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...