I am trying to set up a universal forwarder with an inputs.conf which only contains something like this:
[monitor:///path/to/my/logs]
And then have the splunk server apply different sourcetype values to specific logs within that directory with a rule in props.conf like this:
[source::.../name-of-my-log.log...]
sourcetype = my_sourcetype
However, that does not seem to work. Does the sourcetype need to be defined in inputs.conf on the forwarder machine? Is the syntax of my props.conf correct?
you should put it in inputs.conf, like
[monitor:////.../name-of-my-log1.log]
host = your_host_name
sourcetype = your_sourcetype_name
source = your_source_name
index = your_index_name
[monitor:///.../name-of-my-log2.log]
...
...
...
or you can reassign sourcetype by data routing in props.conf and transforms.conf like
in props.conf
[your sourcetype name]
TRANSFORMS-XXXSourcetyping = XXXSourcetyping
in transforms.conf
[XXXSourcetyping]
REGEX = yourREGEX
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::your_sourcetype_name