topic Re: Why is the sourcetype not being considered? in Getting Data In

Why is the sourcetype not being considered?

andrewtrobec — Wed, 12 Jan 2022 19:46:30 GMT

Hello!

I have a really simple unix based shell script that returns info about the httpd (Apache) service. The script is encapsulated in an input, so the printf statement becomes the event. Each event is one line only.

Here is an indexed event coming from the UF (with highlights that I will explain successively):

For some reason the sourcetype is not working since _time is not what I specify, rather it is half from the field I want (timestamp in green) and half some text in the payload that i do not want (date in red).

The sourcetype is currently this (it has gone through many evolutions):

[linux:httpdinfo] SHOULD_LINEMERGE = false KV_MODE = auto MAX_TIMESTAMP_LOOKAHEAD = 30 TIME_FORMAT = %Y-%m-%d %H:%M:%S %z

No matter what I try I cannot seem to get it to work.

Could somebody give me a push in the right direction?

Thanks!

Andrew

Re: Why is the sourcetype not being considered?

richgalloway — Wed, 12 Jan 2022 20:31:25 GMT

Is the sourcetype set correctly in inputs.conf?

Try this props.conf settings:

[linux:httpdinfo] SHOULD_LINEMERGE = false KV_MODE = auto MAX_TIMESTAMP_LOOKAHEAD = 30 TIME_PREFIX = date=" TIME_FORMAT = %Y-%m-%d %H:%M:%S %z

Re: Why is the sourcetype not being considered?

andrewtrobec — Thu, 13 Jan 2022 12:07:44 GMT

@richgalloway Thanks for taking the time, hope you're well!

Unfortunately the suggestion does not work. It continues to index as before. Here is a tabled output with the indextime as well (timezone gets localized, I am on CET while raw is UTC):

Potentially useful info: the sourcetype is defined in the props.conf belonging to the app that has been deployed to UF via DS. It is not defined anywhere on the indexer that receives the data. This same app contains the shell script as well as inputs.conf.

Best regards,

Andrew

Re: Why is the sourcetype not being considered?

richgalloway — Thu, 13 Jan 2022 12:48:24 GMT

@andrewtrobec wrote:
Potentially useful info: the sourcetype is defined in the props.conf belonging to the app that has been deployed to UF via DS. It is not defined anywhere on the indexer that receives the data.

There's the problem. The props.conf settings must be on the indexer because it is there that timestamp extraction is done.

Re: Why is the sourcetype not being considered?

andrewtrobec — Thu, 13 Jan 2022 13:33:36 GMT

@richgalloway That did the trick. Thanks Rich, appreciate your expert support as always ❤️