topic Re: sourcetype override in Getting Data In

sourcetype override

pmr — Mon, 28 Sep 2020 09:10:42 GMT

I'm having issue overriding sourcetype thro props.conf. my config is on the inputs.conf on a forwarder i'm setting a generic sourcetype of network_device and then overriding that sourcetype on the indexer with props.conf, but it seems to be not working. here's my configs :

inputs.conf on forwarder :

[monitor:///opt/log]
host_segment = 3
sourcetype = network_device

props.conf on indexer :

[network_device]
TRANSFORMS-sourcetype_cisco_wap = cisco_wap_device

transforms.conf on indexer :

[cisco_wap_device]
DEST_KEY = MetaData:Sourcetype
REGEX = \:\s(%DOT11)-\d+-\S+
FORMAT = sourcetype::cisco_wap

The events are coming in all right and getting sourcetype'd as network_device, but its not source typing as cisco_wap. I've also tried using source:: but doesnt work either. I know am making something silly, but cant figure out. tried using splunk cmd btool --debug and it does show transform being used. but why isn't it getting sourcetyped as cisco_wap ?

Any help here will greatly help me.

thanks
pmr

Re: sourcetype override

woodcock — Tue, 15 Nov 2011 20:46:06 GMT

You did not show an example of your events. Without this we cannot validate your REGEX which is where these kinds of problems usually are (you think your REGEX is correct but it has a bug so that is the problem, not the way you've configured everything else).

Re: sourcetype override

gkanapathy — Thu, 17 Nov 2011 16:11:16 GMT

If the forwarder is a Heavy (vs Light or Universal) forwarder, then the transforms (and the config files) must be on the forwarder rather than the indexer.

See here for details.

Re: sourcetype override

crt89 — Thu, 24 Sep 2015 06:23:24 GMT

Just want to say I did this process and I have managed to override the forwarder's sourcetype to my indexer. Thanks