Getting Data In

Applying different extractions to the same source from different hosts

krisreeves
Path Finder

I have two groups of servers that are both running haproxy, and the logs are in the same location (e.g. /var/log/haproxy.log). The log format is different for each of them. I'd like to specify to apply one REPORT transform to haproxy logs coming from *.foo.com and a different REPORT transform to haproxy logs coming from *.bar.com (search-time field extractions). I can't change the sourcetype name itself, it's expected to be 'haproxy' in both cases.

I can't determine any easy way to have a props.conf stanza that matches both a source AND a host, but it seems wasteful and slow to run two giant regular expressions for every line when only one needs to be applied.

Are there any config tricks that can be used here?

0 Karma

FrankVl
Ultra Champion

One trick can be to create a symlink that contains the server’s name (or some other string that helps you keep the two formats apart) which points tot the original log folder. Then point Splunk to the symlink (can still be a generic input stanza by using wildcard), such that the source value now becomes host specific.

We use this often to identify what syslog server a certain event passed through while keeping the original sending device in the host field.

0 Karma

ddrillic
Ultra Champion

It's interesting as you can use wildcards and regex for source and host stanzas in props.conf... but you need a combo ; - )

@MuS spoke to that at Can I have multiple specs (host, source, sourcetype) in props.conf?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...