Getting Data In

How to undo a command that changed the name of my sourcetype?

jgorman_THG
Explorer

Hello,

For some reason, when setting-up some heavy forwarders to accept syslog data on UDP 514, a colleague of mine ran the following command:

Splunk add UDP 514 -sourcetype udp:514. 

This added the following stanza to %splunkhome%/etc/apps/search/local/inputs.conf:

[udp://514]
connection_host = ip
sourcetype = udp:514

This is forcing sourcetype name "udp:514" on all the data that come in on that port.

My question is, if I just remove the "sourcetype = udp:514", will all future data be assigned the correct automatic sourcetypes?

Thanks,

JG

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Yes correct. You define the sourcetype in inputs.conf which your co-worker has done. You can remove the sourcetype line and it will auto assign the sourcetype. Reminder to restart the Splunk service for this change to take affect

0 Karma

jgorman_THG
Explorer

hi,

Thanks for your help.

Do I need to restart just the heavy forwarders, or the indexers as well?

Thanks,

JG

0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

You should only need to restart the heavy forwarder(s).

0 Karma

jgorman_THG
Explorer

HI!

I made the change and restarted the forwarders to no avail. I also restarted the indexer for good measure, but its still showing that same sourcetype.

Can you think of what else it might be or how else I could troubleshoot this?

Thanks,

JG

0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

You can remove that sourcetype statement. THe sourcetype than will be determined by the type of data coming in. You can add something like this:
[udp//:somehostip:514]
sourcetype=somesourcetype
[udp//:someotherhostip:514]
sourcetype=someothersourcetype

The statement:
[udp//:somehostip:514]
Means, accept only from this remote host on port 514, and apply this stanza to that host's data incoming, so you can have several stanzas for each host/sourcetype combo.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...