Hello,
For some reason, when setting-up some heavy forwarders to accept syslog data on UDP 514, a colleague of mine ran the following command:
Splunk add UDP 514 -sourcetype udp:514.
This added the following stanza to %splunkhome%/etc/apps/search/local/inputs.conf:
[udp://514]
connection_host = ip
sourcetype = udp:514
This is forcing sourcetype name "udp:514" on all the data that come in on that port.
My question is, if I just remove the "sourcetype = udp:514", will all future data be assigned the correct automatic sourcetypes?
Thanks,
JG
Yes correct. You define the sourcetype in inputs.conf
which your co-worker has done. You can remove the sourcetype line and it will auto assign the sourcetype. Reminder to restart the Splunk service for this change to take affect
hi,
Thanks for your help.
Do I need to restart just the heavy forwarders, or the indexers as well?
Thanks,
JG
You should only need to restart the heavy forwarder(s).
HI!
I made the change and restarted the forwarders to no avail. I also restarted the indexer for good measure, but its still showing that same sourcetype.
Can you think of what else it might be or how else I could troubleshoot this?
Thanks,
JG
You can remove that sourcetype statement. THe sourcetype than will be determined by the type of data coming in. You can add something like this:
[udp//:somehostip:514]
sourcetype=somesourcetype
[udp//:someotherhostip:514]
sourcetype=someothersourcetype
The statement:
[udp//:somehostip:514]
Means, accept only from this remote host on port 514, and apply this stanza to that host's data incoming, so you can have several stanzas for each host/sourcetype combo.