Getting Data In

Windows Event Log Sourcetype Overrride

Wallen
Explorer

I have the following on my indexer's props.conf:

[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
sourcetype = WinPrintMon

However, both the source and sourcetype in the events still come up as "WinEventLog:Microsoft-Windows-PrintService/Operational". According to the props.conf documentation I shouldn't have to build a regex and a transform in order to rename this sourcetype.

What am I doing wrong?

Tags (2)
1 Solution

strive
Influencer

Try this:
In transforms.conf
[set_sourcetype_WinEventLog]
REGEX =
FORMAT = sourcetype::WinPrintMon
DEST_KEY = MetaData:Sourcetype

In props.conf
[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
TRANSFORMS-changesourcetype = set_sourcetype_WinEventLog

Note: write your regex

View solution in original post

strive
Influencer

I converted my comment to answer. See if you can add your comment below to the answer

0 Karma

strive
Influencer

Try this:
In transforms.conf
[set_sourcetype_WinEventLog]
REGEX =
FORMAT = sourcetype::WinPrintMon
DEST_KEY = MetaData:Sourcetype

In props.conf
[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
TRANSFORMS-changesourcetype = set_sourcetype_WinEventLog

Note: write your regex

Wallen
Explorer

It works with a Regex = \w*, however that doesn't explain why the props.conf docs state you don't need a transform when based on source. I'll mark this as the answer anyway. Thanks.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...