topic Re: Can a sourcetype be applied on the server, or does it need to be applied in the forwarder? in Getting Data In

Can a sourcetype be applied on the server, or does it need to be applied in the forwarder?

wtanaka — Fri, 19 Aug 2011 08:12:57 GMT

I am trying to set up a universal forwarder with an inputs.conf which only contains something like this:

[monitor:///path/to/my/logs]

And then have the splunk server apply different sourcetype values to specific logs within that directory with a rule in props.conf like this:

[source::.../name-of-my-log.log...]
sourcetype = my_sourcetype

However, that does not seem to work. Does the sourcetype need to be defined in inputs.conf on the forwarder machine? Is the syntax of my props.conf correct?

Re: Can a sourcetype be applied on the server, or does it need to be applied in the forwarder?

hjwang — Fri, 19 Aug 2011 09:13:04 GMT

you should put it in inputs.conf, like

[monitor:////.../name-of-my-log1.log]
host = your_host_name
sourcetype = your_sourcetype_name
source = your_source_name
index = your_index_name

[monitor:///.../name-of-my-log2.log]
...
...
...

or you can reassign sourcetype by data routing in props.conf and transforms.conf like

in props.conf
[your sourcetype name]
TRANSFORMS-XXXSourcetyping = XXXSourcetyping

in transforms.conf
[XXXSourcetyping]
REGEX = yourREGEX
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::your_sourcetype_name