Getting Data In

Can a sourcetype be applied on the server, or does it need to be applied in the forwarder?

wtanaka
Explorer

I am trying to set up a universal forwarder with an inputs.conf which only contains something like this:

[monitor:///path/to/my/logs]

And then have the splunk server apply different sourcetype values to specific logs within that directory with a rule in props.conf like this:

[source::.../name-of-my-log.log...]
sourcetype = my_sourcetype

However, that does not seem to work. Does the sourcetype need to be defined in inputs.conf on the forwarder machine? Is the syntax of my props.conf correct?

Tags (1)

hjwang
Contributor

you should put it in inputs.conf, like

[monitor:////.../name-of-my-log1.log]
host = your_host_name
sourcetype = your_sourcetype_name
source = your_source_name
index = your_index_name

[monitor:///.../name-of-my-log2.log]
...
...
...

or you can reassign sourcetype by data routing in props.conf and transforms.conf like

in props.conf
[your sourcetype name]
TRANSFORMS-XXXSourcetyping = XXXSourcetyping

in transforms.conf
[XXXSourcetyping]
REGEX = yourREGEX
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::your_sourcetype_name
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...