Getting Data In

How to use transforms.conf to assign a custom index and sourcetype?

adamblock2
Path Finder

I am currently trying, unsuccessfully, to assign a custom sourcetype and index from within a local/transforms.conf file.

The following is a sample log entry:

Oct 20 18:00:01 cc-mailserver event="Mail Details" src_ip="x.y.251.54" src_port="57709" dst_ip="x.y.17.128" dst_port="25" message_date="Tue, 20 Oct 2015 18:11:06 -0400 (EDT)" from="Bamboo <Bamboo@myserver.net>" to="Bamboo2@myserver.net" reply="" envel_from="<Bamboo@myserver.net>" 

The following are the entries in my transforms.conf file:

Index Routing

[force_index_for_mail_scrape]
REGEX = cc-mailserver
FORMAT = security
DEST_KEY = _MetaData:Index

Sourcetype Routing

[force_sourcetype_for_mail_scrape]
REGEX = cc-mailserver
FORMAT = sourcetype::mail_scrape
DEST_KEY = MetaData:Sourcetype

The data is currently appearing with index=main and sourcetype=mail_scrape-3. The above config is being pushed both to the search heads as well as the indexers.

Any assistance would be appreciated.

0 Karma
1 Solution

adamblock2
Path Finder

I re-checked the props.conf file, and I noticed that the values "force_index_for_mail_scrape" and "force_sourcetype_for_mail_scrape" had not been added. Once the values were added, the custom index and sourcetype values were applied properly.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Update pros.conf like this:

[yourSourceType]
TRANSFORMS-this_text_does_not_really_matter = force_index_for_mail_scrape, force_sourcetype_for_mail_scrape

adamblock2
Path Finder

I re-checked the props.conf file, and I noticed that the values "force_index_for_mail_scrape" and "force_sourcetype_for_mail_scrape" had not been added. Once the values were added, the custom index and sourcetype values were applied properly.

0 Karma

MuS
SplunkTrust
SplunkTrust

what does the props.conf look like and did you restart spunk after the change? Also note this will only be valid for new events.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...