Getting Data In

Change sourcetype in props.conf

dswanson99
Path Finder

I have a lwf sending apache logs (/var/log/httpd/access.log) to an indexer and they're being sourcetyped as 'unknown'.

On the forwarder in props.conf I have:

[source::/var/log/httpd/access.log(.\d+)?]
sourcetype = apache_access

Assuming this is the correct place, what am I doing wrong. I think I might be able to also do a transform but thought I'd stick with this for now.

Thanks

Tags (1)

DUThibault
Contributor

The forwarder's props.conf must have a force_local_processing = true clause in the appropriate sourcetype or source:: stanza. Be aware that this will make the forwarder's SEDCMD and TRANSFORMS clauses apply and prevent those on the indexer from applying. Forwarders cannot do any search-time extractions, transformations, lookups or aliasing.

0 Karma

brianirwin
Path Finder

If you have a file/directory that is matched in multiple regex patterns it is important to help Splunk know which one you want to win. Defaul priority is 100, and it is possible that you have something like /var/log defined with another sourcetype.

I would try changing the priority in your props.conf to be > 100, and maybe just use a regex at the end. You can specify what files to eat in your inputs.conf

props.conf [source::/var/log/httpd/access.log*] sourcetype = apache_access priority = 101

I hope that helps.

0 Karma

dswanson99
Path Finder

I wish that was the problem, but no they're access.log.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Looks right to me, and you would much rather do this than a transform. are you sure the file isn't access_log vs access.log?

0 Karma

Branden
Builder

I set my sourcetype in inputs.conf. Here's what my inputs.conf looks like:

[monitor:///etc/httpd/logs/ssl_access_log]
index=access
sourcetype=apache-access

Hope that helps!

0 Karma

Lowell
Super Champion

Your log files end up under /etc? That seems odd.

0 Karma

dswanson99
Path Finder

Yes that does help thanks, but then I have to break out my access logs into a separate input. Right now I'm watching all of /var/log and the access logs are within there.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...