Getting Data In

Splitting sourcetype from a monitor input stanza

tsunamii
Path Finder

I am using a Universal Forwarder to monitor the following directories and files, but somehow it is not routing it to the correct sourcetype. Everything seems to be routing to sourcetype of corepoint_error_log instead.


inputs.conf --
[monitor://E:\Program Files (x86)\Corepoint\CIE\Logs\*\CIEngMonSvc.log]
sourcetype = corepoint_error_log
index = capsule
ignoreOlderThan = 3d
crcSalt = <SOURCE>

[monitor://E:\Program Files (x86)\Corepoint\CIE\Logs\*\CIEngSvc.log]
sourcetype = corepoint_transaction_log
index = capsule
ignoreOlderThan = 3d
crcSalt = <SOURCE>

Tags (1)
0 Karma

splunkIT
Splunk Employee
Splunk Employee

This method will not work because there are conflicts with the stanzas above. You would need to use whitelist in the inputs.conf stanza, along with props.conf and transforms.conf stanzas to route it to the correct sourcetype.


inputs.conf--
[monitor://E:\Program Files (x86)\Corepoint\CIE\Logs]
whitelist = (CIEngMonSvc\.log|CIEngSvc\.log)
sourcetype = corepoint_error_log
index = capsule
ignoreOlderThan = 3d
crcSalt = <SOURCE>

props.conf--
[corepoint_error_log]
TRANSFORMS-transaction_log = transaction_log

transforms.conf--
[transaction_log]
SOURCE_KEY = MetaData:Source
REGEX = CIEngSvc\.log
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::corepoint_transaction_log

jonuwz
Influencer

would you mind explaining the stanza conflict ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...