Getting Data In

Why is the overriding of sourcetype and index not working?

jamesvz84
Communicator

I am trying to take a TCP feed that is setting sourcetype=sources, and want to split the events into separate indexes and sourcetypes based on their content. However, this is not working for me.

Configs are below, and are located on the heavy forwarder. Any ideas?

props.conf

[sources]
TRANSFORMS-reassign = fireeye_index,fireeye_sourcetype,fortigate_index,fortigate_sourcetype

transforms.conf

[fireeye_index]
DEST_KEY =_MetaData:Index
REGEX = |FireEye|
FORMAT = fireeye

[fireeye_sourcetype]
REGEX = |FireEye|
FORMAT = sourcetype::fireeye
DEST_KEY = MetaData:Sourcetype

[fortigate_index]
DEST_KEY =_MetaData:Index
REGEX = devname=.+fw.+device_id=
DEST_KEY = fortigate

[fortigate_sourcetype]
REGEX = devname=.+fw.+device_id=
FORMAT = sourcetype::fortigate
DEST_KEY = MetaData:Sourcetype
0 Karma

masonmorales
Influencer

In each of your transforms stanzas, you should also have:

SOURCE_KEY = MetaData:Sourcetype

masonmorales
Influencer

Also, what are you trying to match with REGEX = |FireEye|? The pipe in REX acts as an OR operator, so if you have literal pipes, then you need to escape them with a backslash. If you don't have pipes, remove them as that may be part of the problem.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...