topic Re: Renaming sourcetype and source with props and transforms in Getting Data In

Renaming sourcetype and source with props and transforms

barak_l_griffis — Mon, 28 Sep 2020 14:03:07 GMT

We have some VIOS servers that are special-purpose machines that aren't allowed to have a UF installed. I want to hotwire the Splunk_TA_nix scripts to drop their output on an NFS share for Splunk to pick up. Each VIOS server will drop in a different directory under /exports/ and each script will write to a file with it's name (df.sh > df.log)
I want df.log to go to index=os, sourcetype=df, source=df
ps, iostat, vmstat, etc...
This isn't working:

inputs.conf

[monitor:///exports/vio*/*.log]
disabled = 0
followTail = 0
host =
host_segment = 2
index = os

props.conf

[source:.../df.log]
sourcetype = df
TRANSFORMS-viosdf = viosdf

[source:.../psdf.log]
sourcetype = ps
TRANSFORMS-viosps = viosps

transforms.conf

[viosdf]
DEST_KEY = MetaData:Source
FORMAT = source::df

[viosps]
DEST_KEY = MetaData:Source
FORMAT = source::ps

Re: Renaming sourcetype and source with props and transforms

kristian_kolb — Fri, 07 Jun 2013 06:28:34 GMT

Why not do it all in inputs.conf?

[monitor:///exports/vio*/df.log]
disabled = 0
followTail = 0
host =
host_segment = 2
index = os
sourcetype = df
source = df

[monitor:///exports/vio*/ps.log]
disabled = 0
followTail = 0
host =
host_segment = 2
index = os
sourcetype = ps
source = ps

/Kristian

Re: Renaming sourcetype and source with props and transforms

barak_l_griffis — Fri, 07 Jun 2013 11:02:52 GMT

Ouch. That's painfully obvious and I missed it.
Thanks!

Re: Renaming sourcetype and source with props and transforms

ff9231 — Wed, 26 May 2021 05:36:58 GMT

I don't think it works for defining "source" in inputs.conf

If I define host/host_segment then "source" always go to default to show as filename(which is what I don't want).

I am modifying on Universal Forwarder.

If I don't define host/host_segment then "source" name is OK but host goes to default server name...