topic Re: How to force to set certain fields (host and sourcetype) for events from HEC local stanza for each token in Getting Data In

How to force to set certain fields (host and sourcetype) for events from HEC local stanza for each token

gots — Mon, 14 Aug 2017 19:10:25 GMT

Is it possible to force Splunk to set up specific fields (sourcetype, source, host) from HEC local stanza
but not from event parameters?

For example if i have inputs.conf like:

[http://http_test]
description = test hec input
disabled = 0
connection_host = dns
index = main
source = test_hec_source
sourcetype = test_hec_sourcetype

Client can rewrite index, host, source and sourcetype if post in data json like:

{
  "host": fake_host,
  "sourcetype": fake_sourcetype,
  "index": fake_index,
  "source": fake_source
}

But in certain situations i need to deny modifications of this parameters. Of course i can do it with transforms.conf, but it is not convinient.

Re: How to force to set certain fields (host and sourcetype) for events from HEC local stanza for each token

mdsnmss — Mon, 14 Aug 2017 19:46:18 GMT

You should be able to override source and define sourcetype for HEC during configuration I know for sure. I don't believe you can for host. You should also be able to override fields using props and transforms at the indexers.

props.conf

[<original sourcetype>]
TRANSFORMS-force_host = force_host
TRANSFORMS-force_source = force_source
TRANSFORMS-force_sourcetype=force_sourcetype

transforms.conf

[force_host]
DEST_KEY=MetaData:Host
FORMAT = <your_host>

[force_source]
DEST_KEY=MetaData:Source
FORMAT = <your_source>

[force_sourcetype]
DEST_KEY=MetaData:Sourcetype
FORMAT = <your_sourcetype>

The only thing I am unsure of is Splunk's order of operations. If it changes the sourcetype first, would it no longer see that sourcetype for the event and skip the host and source override? I would have to test but, if so, you should be able to just create a new stanza for the new sourcetype.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Data/Advancedsourcetypeoverrides

Re: How to force to set certain fields (host and sourcetype) for events from HEC local stanza for each token

mdsnmss — Mon, 14 Aug 2017 19:47:15 GMT

In HEC configs, source/sourcetype settings come under the "per-token" settings: http://dev.splunk.com/view/event-collector/SP-CAAAE6Q.

Re: How to force to set certain fields (host and sourcetype) for events from HEC local stanza for each token

gots — Mon, 14 Aug 2017 20:07:34 GMT

you are right about HEC configuration if sourcetype, host and over fields are not defined in event.
But if sender define this fields, he will override valued defined in inputs.conf.