Getting Data In

How can I define new sourcetypes for one single TCP input ?

jimnol
New Member

Hello,

I'm trying to implement Splunk on a really big project.
My team and I already used a LogLogic solution and want to go through a Splunk's one.

The problem is that all the logs of this network (decades Active Directory areas) are currently relayed to the LogLogic SIEM and then to my Splunk Indexer over TCP.
That's means that I can configure only one TCP input on my indexer.

Question is : How can I tell Splunk to define new sourcetypes based on differents events indexed such "This is a Windows Log" or "That is an Arkoon log" etc ... ?

Should I use a Splunk Forwarder to parse data upstream or anything else ?

Thank you in advance for your replies !

PS : Sorry for my English I'm a French student ^^

0 Karma

woodcock
Esteemed Legend
0 Karma

aholzer
Motivator

You can do this with props.conf and transforms.conf.

Your transforms would look something like this:

[force_sourcetype_x]
#regex that matches events that you want to label as sourcetype x
REGEX = sourcetype_x
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::x

Hope this helps

0 Karma

jimnol
New Member

I'll try it next week Splunk's VM is down actually.

Thank you !

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...