topic Re: Issue with Sourcetype name in Getting Data In

Issue with Sourcetype name

alexspunkshell — Fri, 22 Sep 2023 16:52:41 GMT

I am getting different sourcetype name in my logs. But I want the sourcetype name as per conf file.

Below are the screenshots of input.conf, props.conf & transforms.conf .

Props & Transforms

Inputs

Re: Issue with Sourcetype name

richgalloway — Fri, 22 Sep 2023 20:01:42 GMT

Please use btool to ensure no other files add settings for the sourcetype.

splunk btool --debug props list vclog | grep -v "system\/default"

What query created the output in the first screenshot?

Re: Issue with Sourcetype name

alexspunkshell — Fri, 22 Sep 2023 19:04:39 GMT

@richgalloway No luck! But I confirm there is no other files and settings.

Command used : index=vmware | stats count by sourcetype

Currently syslog is ingesting via universal forwarder.

Current configuration

input.conf
[monitor:///opt/syslog/vmware/10.149.xx.xx/*-syslog.log]
disabled = false
host_segment = 4
index = vmware-vclog
sourcetype = vclog
initCrcLength = 2048

Props.conf
[source::/opt/syslog/vmware/10.149.xx.xx/*]
TRANSFORMS-null= setnull

[vclog]
LINE_BREAKER = ([\r\n]+)\<\d+\>\d
SHOULD_LINEMERGE = false

transforms.conf
[setnull]
REGEX = ^\w+\W
DESK_KEY = queue
FORMAT = nullQueue