Getting Data In

Forcing source or sourcetype just isn't working!

Jason
Motivator

I've tried everything and it seems I still can't get my stanzas in props.conf and transforms.conf to overwride sourcetype/source/host.

Props.conf: (in etc/apps/clientname/local/)

[source::/path/to/files/...]
TRANSFORMS-set_sourcetype_for_files = set_sourcetype_for_files
priority = 10

Transforms.conf: (in etc/apps/clientname/local/)

[set_sourcetype_for_files]
SOURCE_KEY = Metadata:Source
DEST_KEY = MetaData:Sourcetype
REGEX = .*/(.*).log
FORMAT = sourcetype::$1

Why is this sourcetype change not sticking?

Tags (1)
1 Solution

Jason
Motivator

Be sure to check your capitalization, as it is case sensitive and DIFFERENT between different lines in transforms.conf!

Here is the equivalent setup that actually worked, note the capitalization differences between SOURCE_KEY/DEST_KEY and FORMAT lines:

props.conf

[source::/path/to/files/...]
TRANSFORMS-set_sourcetype_for_files = set_sourcetype_for_files
priority = 10

transforms.conf

[set_sourcetype_for_files]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Sourcetype
REGEX = .*/(.*).log
FORMAT = sourcetype::$1

View solution in original post

Jason
Motivator

Be sure to check your capitalization, as it is case sensitive and DIFFERENT between different lines in transforms.conf!

Here is the equivalent setup that actually worked, note the capitalization differences between SOURCE_KEY/DEST_KEY and FORMAT lines:

props.conf

[source::/path/to/files/...]
TRANSFORMS-set_sourcetype_for_files = set_sourcetype_for_files
priority = 10

transforms.conf

[set_sourcetype_for_files]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Sourcetype
REGEX = .*/(.*).log
FORMAT = sourcetype::$1

Jason
Motivator

And Sourcetype vs sourcetype.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Just to clarify, it's MetaData vs Metadata.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...