I try this in transforms.conf :
[Hirschmann]
DEST_KEY = MetaData:Sourcetype
REGEX = "\S[A-Z]+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-.\s[A-Z0-9_]+\[[0-9]+\]:\s[a-z0-9_/.]+\([0-9]+\)\s[0-9]+\s%%\s.+"
FORMAT = sourcetype::Hirschmann
(the regex is working when i use * | regex "\S[A-Z]+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-.\s[A-Z0-9_]+\[[0-9]+\]:\s[a-z0-9_/.]+\([0-9]+\)\s[0-9]+\s%%\s.+"
in search bar)
but it's still marked "syslog" on sourcetype
Can you help me ?
You'll need a corresponding props.conf entry, do you have one? It should look roughly like this:
## props.conf
[syslog]
TRANSFORM-force-sourcetype-hirschmann = Hirshmann
Additionally you shouldn't quote your REGEX:
## transforms.conf
[Hirschmann]
DEST_KEY = MetaData:Sourcetype
REGEX = \S[A-Z]+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-.\s[A-Z0-9_]+\[[0=9]+\]:\s[a-z0-9_/.]+\([0-9]+\)\s[0-9]+\s%%\s.+
FORMAT = sourcetype::Hirschmann
You'll need a corresponding props.conf entry, do you have one? It should look roughly like this:
## props.conf
[syslog]
TRANSFORM-force-sourcetype-hirschmann = Hirshmann
Additionally you shouldn't quote your REGEX:
## transforms.conf
[Hirschmann]
DEST_KEY = MetaData:Sourcetype
REGEX = \S[A-Z]+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-.\s[A-Z0-9_]+\[[0=9]+\]:\s[a-z0-9_/.]+\([0-9]+\)\s[0-9]+\s%%\s.+
FORMAT = sourcetype::Hirschmann
Hi, this config setting should go on the first splunk instance that performs parsing. Normally this is either a Heavy Forwarder or an Indexer. See more here;
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings
If you're still not getting any data transformed to the Hirschmann sourcetype, you should probably look closer at the regex. It seems a bit complicated, and there might be easier ways of writing it.
/K
it's not working, i have multiple index, does this count ? also i have forwarders and i am on my main splunk, maybe i need to add this on the right forwarder ?