All Apps and Add-ons

Sourcetyping DHCPD logs out of var/log/messages

jcooperFossil
Path Finder

Utilizing Splunk Cloud

I'm using the Splunk TA Nix app on all my linux servers. Additionally running Splunk Add On for ISC DHCPD on the DHCP servers.

Other than adjusting syslog to write dhcp logs to a new file (which is my preferred way, but running into red tape), how can I have the DHCPD logs be sourcetyped properly?

They're currently going in to /var/log/messages and being picked up by the Splunk TA Nix app and going into the "os" index.

I'd prefer to send them to their own index too, if that is possible.

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

You can route events to different indexes or sourcetypes using props.conf and transforms.conf files on the indexer(s). Here is an example of both, using host as the key. You could also base this on source or sourcetype in props.

**props.conf**
[mycosyslog]
TRANSFORMS-setst = setst_ace, setst_pan
TRANSFORMS-setindex = setindex_pan

**transforms.conf**
[setst_ace]
SOURCE_KEY = MetaData:Host
DEST_KEY = MetaData:Sourcetype
REGEX = [YOUR REGEX HERE]
FORMAT = sourcetype::cisco:ace

[setst_pan]
SOURCE_KEY = MetaData:Host
DEST_KEY = MetaData:Sourcetype
REGEX =  [YOUR REGEX HERE]
FORMAT = sourcetype::pan_log

[setst_ace]
SOURCE_KEY = MetaData:Host
DEST_KEY = _MetaData:Index
REGEX =  [YOUR REGEX HERE]
FORMAT = pan_logs
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Just realizing you indicated Splunk Cloud. This change would require a ticket to get Cloud Ops to put the props.conf and transforms.conf changes in place for you.

0 Karma

jcooperFossil
Path Finder

So I couldn't make that change on the Heavy Forwarder or on the UF?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...