topic Re: sourcetype override in Getting Data In

sourcetype override

jackykitkit — Mon, 16 Sep 2013 10:17:36 GMT

I am new to splunk and i am now going to receive syslog from multiple devices on UDP514, so i cant define a specific sourcetype to UDP:514, right? And I installed the Fortigate apps and edited the /etc/hosts to resolve the IP. I can successfully resolve the IP to hostname "fortigate" and below are my input.conf and props.conf files

input.conf
[udp://514]
connection_host = dns

props.conf
[host::fortigate]
sourcetype = fortigate

It is not working, sourcetype of the data still shown as UDP:514, did i do any wrong?
Thanks for helping

Re: sourcetype override

lguinn2 — Mon, 16 Sep 2013 20:53:25 GMT

Does the host of the data show up as fortigate?

Re: sourcetype override

linu1988 — Mon, 16 Sep 2013 20:59:52 GMT

shouldn't the sourcetype be present in the udp://.. inputs stanza?

Re: sourcetype override

jackykitkit — Tue, 17 Sep 2013 00:34:48 GMT

yes, the host shown as "fortigate" sourcetype and source are UDP:514

Re: sourcetype override

adrianathome — Tue, 17 Sep 2013 01:03:38 GMT

You can do

[udp://iPaddress:514]
Index=foo
sourcetype=bar

Re: sourcetype override

lukejadamec — Tue, 17 Sep 2013 01:24:32 GMT

The input.conf UDP sets the sourcetype, and source.

This will need to be overridden, and a props.conf by itself is not enough.

See this post: http://answers.splunk.com/answers/34251/udp514-and-source-types

Hope this helps.

Re: sourcetype override

jackykitkit — Mon, 28 Sep 2020 14:48:41 GMT

Thanks for helping, i am now successfully override the sourcetype of fortigate, and my config are:

input.conf
[udp://514]
connection_host = dns
sourcetype = syslog

props.conf
[syslog]
TRANSFORMS-sourcetype_and_host_override = fortigate
SHOULD_LINEMERGE = false

transforms.conf
[fortigate]
DEST_KEY = MetaData:Sourcetype
REGEX = fortigate
FORMAT = sourcetype::fortigate

But how can i override the sourcetype if i have another host come from udp514? thanks