topic Re: Transform sourcetype not works in Getting Data In

Why doesn't my Transform sourcetype work?

manuelmosca — Mon, 20 Mar 2023 14:40:47 GMT

Hi, I'm tring to change the sourcetype of all data of a specific source

in props.conf

[source::/var/log/messages]
TRANSFORMS-change_sourcetype = syslog_sourcetype_change

in transform.conf

[syslog_sourcetype_change]
SOURCE_KEY = MetaData:Sourcetype
REGEX = .*
FORMAT = sourcetype::syslog:nix
DEST_KEY = MetaData:Sourcetype

I checked the running config via btool and the stanzas are correctly configured on my heavy forwarder but it not works, the logs remain into syslog sourcetype

Thanks in advance

Re: Transform sourcetype not works

PickleRick — Fri, 17 Mar 2023 16:01:28 GMT

OK, I hope it's only a typo when posting here, because the file should be called transforms.conf, not transform.conf (if you checked with btool, you should have noticed that so I'm assuming that it's only here)

Other than that it looks pretty OK.

Re: Transform sourcetype not works

manuelmosca — Mon, 20 Mar 2023 05:43:17 GMT

Yes is a typo, I forgot the s...

I'm not understanding why it not works, from splunk documentation and you comment the parameters are rights

Re: Transform sourcetype not works

PickleRick — Mon, 20 Mar 2023 13:54:32 GMT

OK. Then are you sure your files are in the right place? What is your data flow and where these settings are?

Re: Transform sourcetype not works

manuelmosca — Wed, 22 Mar 2023 12:46:45 GMT

strange but true, now the config works... I've not changed anything

Thanks