Hi
I want to have a common source field for all my syslog. I have centralized syslog server where I am running splunkforwarder to send all remote hosts logs to splunk.
currently source filed is default which is "/var/log/syslog/%year%/%month%/%date%/%host%/syslog"
what I want is "/var/log/syslog" - I want this static for all logs. how to do this with transforms.conf and props.conf
I know I can do it in input.conf by just mentioning source="/var/log/syslog". I tried that and it works but it's breaking host field. I am overriding host field using host_segment in input.conf. so if I put static source there it breaks host_segment and splunk can't parse host.
current configs,
transform.conf
[source]
FORMAT = source::/var/log/syslog
SOURCE_KEY=MetaData:Source
DEST_KEY = MetaData:Source
props.conf
[sourceoverride]
TRANSFORMS-source = source
SHOULD_LINEMERGE = false
input.conf
[monitor:///var/log/rsyslog/////syslog]
disabled = false
followTail=0
host_segment = 7
blacklist = .(gz)$
sourcetype = syslog
Your transforms.conf is missing the REGEX part. Even though you don't need it functionally, it is a mandatory setting for indextime transforms.
So just add REGEX = .
and then I think it should work.
Just tried this. didn't work. Somehow it seems like splunk is ignoring transforms and props config files. no effect at all.
Did you try my suggestion combined with the other answer about using [syslog]?
Because using [sourceoverride] in your props.conf is incorrect. You need to put your actual sourcetype between de square brackets not some
random word.
Can you try props as below:
props.conf
[syslog]
TRANSFORMS-source = source
SHOULD_LINEMERGE = false
tried your suggestion, didn't work. no effect.