Hi,
I am receiving syslog data from various type of devices, but all are on udp:514. I need to overwrite the sourcetype based on Host IP address. Following are the configurations I did, but this is not taking effective. My search result shows sourcetype as [syslog] only.
Can you please help me where I am doing the mistake.
Configurations made in $SPLUNK_HOME/etc/system/local directory
inputs.conf
[udp://514]
connection_host = ip
source = udp_514
sourcetype = syslog
props.conf
[host::10\.0\.6\.23]
sourcetype = websense
[host::10\.0\.6\.113]
sourcetype = cisco:ios
This link will help you
You set the sourcetype in transforms.conf and then use that in props.conf file
This link will help you
You set the sourcetype in transforms.conf and then use that in props.conf file
Check the sourcetype configuration section in http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf
Thaks Strive, Its working.
But any idea why settings in props.conf alone (without transforms.conf) not working.
HI Strive,
Here no forwarders in this deployment, as all syslog devices sending data on udp:514. I have splunk indexer acting as syslog server to receive on udp:514.
All configurations made in Splunk INDEXER. (system/local directory)
Yes I am seeing different hosts (IPs) on search
Thansk, Anki
Where do you have your props.conf? Is it on forwarder or indexer? what type of forwarder are you using? In your search results are you seeing different IP addresses as hosts?