topic Logs not picking sourcetype from props.conf in apps/local folder on heavy forwarder in Getting Data In

Logs not picking sourcetype from props.conf in apps/local folder on heavy forwarder

arunkumarkyamaj — Fri, 14 Feb 2020 15:32:54 GMT

Hi,
we want to parse the logs on HF before logs are forwarded to indexers. logs are forwarded from universal forwarder to heavy forwarder. I have given sourcetype in inputs.conf on UF and created props.conf with same sourcetype value stanza( extract = regex). logs are comeing with sourcetype i have given in inputs.conf but its not picking file in props.conf where the regex is. so logs are not parsed. i have tested props.conf and it parsed correctly on test environment but this by uploading file. Am i missing anything here ?

Re: Logs not picking sourcetype from props.conf in apps/local folder on heavy forwarder

richgalloway — Fri, 14 Feb 2020 18:22:13 GMT

Did you load the props.conf file on the HF and restart the HF?

Re: Logs not picking sourcetype from props.conf in apps/local folder on heavy forwarder

arunkumarkyamaj — Fri, 14 Feb 2020 18:24:33 GMT

yes. i did.

Re: Logs not picking sourcetype from props.conf in apps/local folder on heavy forwarder

arjunpkishore5 — Fri, 14 Feb 2020 19:19:32 GMT

Have you also placed the props.conf on the UF? If yes, remove the props.conf on the UF. Could you also paste the contents of the props.conf here?

Re: Logs not picking sourcetype from props.conf in apps/local folder on heavy forwarder

arjunpkishore5 — Fri, 14 Feb 2020 20:25:04 GMT

There's your problem, EXTRACT is used to define search time filed extractions and not index time extractions, these work only on your search head.

On your heavy forwarder, you need to use TRANSFORM- along with an accompanying transforms.conf - https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Transformsconf

Re: Logs not picking sourcetype from props.conf in apps/local folder on heavy forwarder

arunkumarkyamaj — Fri, 14 Feb 2020 20:34:57 GMT

Thank you! that worked.