topic Re: I want source type separation using prop.conf. in Getting Data In

I want source type separation using prop.conf.

noott211 — Tue, 28 Dec 2021 06:34:54 GMT

index name = my_index
source name = my_source
sourcetype = my_sourcetpye
host = 192.168.0.10

-----------------------------
The field action is =allow -> my_allow.
Action = deny -> my_deny
other -> my_myontype
I want to change it to this.

help me

Re: I want source type separation using prop.conf.

isoutamo — Tue, 28 Dec 2021 09:28:19 GMT

In splunk concept sourcetype means lexical format of log event/source. Based on that it's not a good practice to name sourcetype by value of field (if I understood right what you are asking?). Instead of sourcetype you should use eventtype to separate those events inside sourcetype.

r. Ismo

Re: I want source type separation using prop.conf.

noott211 — Tue, 28 Dec 2021 11:16:07 GMT

I want to separate data whenever it comes in. Can similar effects be achieved using prop.conf or transaction.conf?

Re: I want source type separation using prop.conf.

isoutamo — Tue, 28 Dec 2021 14:02:32 GMT

If I understood right your request you could do it with props.conf and transforms.conf (you need both). Look e.g. CLONE_SOURCETYPE for that. If there are lot of those values then it could be hard to manage all those versions.