topic Re: How can I define new sourcetypes for one single TCP input ? in Getting Data In

How can I define new sourcetypes for one single TCP input ?

jimnol — Fri, 30 Oct 2015 15:06:25 GMT

Hello,

I'm trying to implement Splunk on a really big project.
My team and I already used a LogLogic solution and want to go through a Splunk's one.

The problem is that all the logs of this network (decades Active Directory areas) are currently relayed to the LogLogic SIEM and then to my Splunk Indexer over TCP.
That's means that I can configure only one TCP input on my indexer.

Question is : How can I tell Splunk to define new sourcetypes based on differents events indexed such "This is a Windows Log" or "That is an Arkoon log" etc ... ?

Should I use a Splunk Forwarder to parse data upstream or anything else ?

Thank you in advance for your replies !

PS : Sorry for my English I'm a French student ^^

Re: How can I define new sourcetypes for one single TCP input ?

aholzer — Fri, 30 Oct 2015 15:41:51 GMT

You can do this with props.conf and transforms.conf.

Your transforms would look something like this:

[force_sourcetype_x]
#regex that matches events that you want to label as sourcetype x
REGEX = sourcetype_x
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::x

Hope this helps

Re: How can I define new sourcetypes for one single TCP input ?

jimnol — Fri, 30 Oct 2015 15:46:47 GMT

I'll try it next week Splunk's VM is down actually.

Thank you !

Re: How can I define new sourcetypes for one single TCP input ?

woodcock — Fri, 30 Oct 2015 17:25:27 GMT

It is all documented clearly here:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides