topic Windows Event Log Sourcetype Overrride in Getting Data In

Windows Event Log Sourcetype Overrride

Wallen — Thu, 24 Jul 2014 15:02:32 GMT

I have the following on my indexer's props.conf:

[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
sourcetype = WinPrintMon

However, both the source and sourcetype in the events still come up as "WinEventLog:Microsoft-Windows-PrintService/Operational". According to the props.conf documentation I shouldn't have to build a regex and a transform in order to rename this sourcetype.

What am I doing wrong?

Re: Windows Event Log Sourcetype Overrride

strive — Mon, 28 Sep 2020 17:10:20 GMT

Try this:
In transforms.conf
[set_sourcetype_WinEventLog]
REGEX =
FORMAT = sourcetype::WinPrintMon
DEST_KEY = MetaData:Sourcetype

In props.conf
[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
TRANSFORMS-changesourcetype = set_sourcetype_WinEventLog

Note: write your regex

Re: Windows Event Log Sourcetype Overrride

Wallen — Thu, 24 Jul 2014 16:08:06 GMT

It works with a Regex = \w*, however that doesn't explain why the props.conf docs state you don't need a transform when based on source. I'll mark this as the answer anyway. Thanks.

Re: Windows Event Log Sourcetype Overrride

strive — Thu, 24 Jul 2014 17:16:48 GMT

I converted my comment to answer. See if you can add your comment below to the answer