topic Re: props.conf not working in Getting Data In

props.conf not working

MOberschelp — Fri, 27 Feb 2015 10:23:58 GMT

Hello,

I try to user props.conf to change the sourcetype (in this case from cisco:asa to something else)
I've set up a props.conf and transforms.conf in the "local" folder. But this doesn't work at all.

Here is the props.conf:

[source::udp:514]
TRANSFORMS-changesourcetype = syslog_ciscoesatextmail
TRANSFORMS-changesourcetype = syslog_rsaauthmgr

Here is the transforms.conf:

[syslog_ciscoesatextmail]
REGEX = :dds+(?:d+s+|(?:user|daemon|local.?).w+s+)*[?(10.1.1.152|10.1.1.153)[w.-]{2,})]?s 
FORMAT = sourcetype::cisco:esa:textmail
DEST_KEY = MetaData:Sourcetype

[syslog_rsaauthmgr]
REGEX = :dds+(?:d+s+|(?:user|daemon|local.?).w+s+)*[?(10.1.1.24|10.1.1.25)[w.-]{2,})]?s
FORMAT = sourcetype::RSA_AUTH_MGR
DEST_KEY = MetaData:Sourcetype

In the search app I still see the logs from the specified host as sourcetype:syslog

What am I doing wrong?
A restart has already been done with | extract reload=true and with service restart in windows.

Re: props.conf not working

dart — Fri, 27 Feb 2015 10:32:26 GMT

Is your data coming in as syslog from a file, with the host in each event? Can you show your input configuration?
Also some of the cisco addons override sourcetypes and this may be what's getting it set to cisco:asa

Re: props.conf not working

MOberschelp — Fri, 27 Feb 2015 10:39:12 GMT

I've set up UDP 514 as sourcetype cisco:asa. I did this because about 90% of the syslogging systems are cisco:asa.

but I have some other vendor / hardware like RSA SecurID Appliance, BlueCoat Proxy SG and Netscaler sending also via syslog. The syslog is directly send to my splunk enterprise server.

The following apps are installed on the splunk server:
Cisco Security Suite
Splunk Add-on for Cisco ASA
Splunk Add-on for Cisco ESA
Splunk Add-on for Cisco WSA

Do you need further information?
Sorry, but I am very new in configuring splunk. This is my first week with this product.

Re: props.conf not working

dart — Fri, 27 Feb 2015 10:55:02 GMT

No problem and welcome to using Splunk! My next question is do the hosts show up with IP addresses in Splunk in the host field, or do they have DNS names?

Re: props.conf not working

MOberschelp — Fri, 27 Feb 2015 11:07:21 GMT

the hosts show up with ip addresses. we have no dns resolution for this hosts.

Or is there any way to do an automatic sourcetype detection?
Thanks so far!

Re: props.conf not working

wpreston — Fri, 27 Feb 2015 14:08:43 GMT

To override a sourcetype, you need to use both transforms.conf and props.conf. Here is the information from the docs: Override sourcetypes on a per event basis. Try configuring your props.conf and transforms.conf as shown there and see if it works better for you.

Re: props.conf not working

MOberschelp — Mon, 28 Sep 2020 19:09:00 GMT

I've tried to do this, but this won't work.

Here is the props.conf:
[source::udp:514] TRANSFORMS-changesourcetype = syslog_ciscoesatextmail TRANSFORMS-changesourcetype = syslog_rsaauthmgr

Here is the transforms.conf:
[syslog_ciscoesatextmail] REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(10.1.1.152|10.1.1.153)[\w.-]{2,})]?\s FORMAT = sourcetype::cisco:esa:textmail DEST_KEY = MetaData:Sourcetype

[syslog_rsaauthmgr]
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(10.1.1.24|10.1.1.25)[\w.-]{2,})]?\s
FORMAT = sourcetype::RSA_AUTH_MGR
DEST_KEY = MetaData:Sourcetype

In the search app I still see the logs from the specified host as sourcetype:syslog