topic Re: Why props.conf configurations not taking effect? in Getting Data In

Why props.conf configurations not taking effect?

ankireddy007 — Mon, 21 Jul 2014 07:01:35 GMT

Hi,

I am receiving syslog data from various type of devices, but all are on udp:514. I need to overwrite the sourcetype based on Host IP address. Following are the configurations I did, but this is not taking effective. My search result shows sourcetype as [syslog] only.
Can you please help me where I am doing the mistake.

Configurations made in $SPLUNK_HOME/etc/system/local directory

    inputs.conf
        [udp://514]
        connection_host = ip
        source = udp_514
        sourcetype = syslog

    props.conf
        [host::10\.0\.6\.23]
        sourcetype = websense

        [host::10\.0\.6\.113]
        sourcetype = cisco:ios

Re: Why props.conf configurations not taking effect?

strive — Mon, 21 Jul 2014 07:51:22 GMT

Where do you have your props.conf? Is it on forwarder or indexer? what type of forwarder are you using? In your search results are you seeing different IP addresses as hosts?

Re: Why props.conf configurations not taking effect?

ankireddy007 — Mon, 21 Jul 2014 07:56:35 GMT

HI Strive,

Here no forwarders in this deployment, as all syslog devices sending data on udp:514. I have splunk indexer acting as syslog server to receive on udp:514.
All configurations made in Splunk INDEXER. (system/local directory)
Yes I am seeing different hosts (IPs) on search

Thansk, Anki

Re: Why props.conf configurations not taking effect?

strive — Mon, 21 Jul 2014 07:59:15 GMT

This link will help you

http://answers.splunk.com/answers/3687/host-stanza-in-propsconf-not-being-honored-for-udp514-data-sources

You set the sourcetype in transforms.conf and then use that in props.conf file

Re: Why props.conf configurations not taking effect?

ankireddy007 — Mon, 21 Jul 2014 09:18:42 GMT

Thaks Strive, Its working.
But any idea why settings in props.conf alone (without transforms.conf) not working.

Re: Why props.conf configurations not taking effect?

strive — Mon, 21 Jul 2014 10:40:30 GMT

Check the sourcetype configuration section in http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf