All Apps and Add-ons

How to change assigned sourcetype for Add-on for Unix and Linux from syslog

ejwade
Contributor

We have the Splunk Add-on for Unix and Linux installed on a deployment server, and pushed out to many Linux hosts. Currently, we're having issues with the following stanza in the inputs.conf file:

[monitor:///var/log]
whitelist=(.log|log$|messages|secure|auth|mesg$|cron$|acpid$|.out)
blacklist=(lastlog|anaconda.syslog)
index=os
disabled = 0

This directory is monitored using universal forwarders, and sent to indexers to be parsed. At some point, the sourcetype "syslog" is given to this log data. Is this common? I thought I'd seen /var/log/message as sourcetype="messages" in the past.

0 Karma

micahkemp
Champion

Check to see if you have the appropriate tag values for the events with the syslog sourcetype. As long as those are correct, the CIM should be just fine with that data. The CIM doesn't (by default) care about sourcetypes.

0 Karma

ejwade
Contributor

You're correct. And the corresponding App expecting the sourcetype=syslog. Thanks for your help, @micahkemp.

0 Karma

micahkemp
Champion

Which values do you see for source for the sourcetype syslog? That is indeed a common sourcetype, but I'm not sure all of those files should have that sourcetype in the end. The app's props.conf sets different sourcetypes based on the filename.

I don't see any reference to a messages sourcetype in the TA.

ejwade
Contributor

I see the filepath for the log (e.g., /var/log/messages) as the source, but the sourcetype gets tagged as "syslog". You're correct - the TA documentation does not specify messages sourcetype, but I was surprised to see "syslog". Curious if this was expected behavior, and whether it works with the App and CIM.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...