topic Changing the sourcetype to remove spaces in Getting Data In

Changing the sourcetype to remove spaces

jwhughes58 — Wed, 30 Sep 2020 03:41:16 GMT

I'm working on a TA to process Venafi messages brought in via RestAPI. When I was testing I used hostname in the props.conf file to call the transform to change the sourcetype. I can't do that in production because the production Windows servers send logs via the UF. I tried this yesterday in test.

props.conf
[source::Venafi\sTrust\sProtection\sPlatform]
TZ = US/Pacific
TRANSFORMS-venafi = venafi_sourcetype_rename

transforms.conf
[venafi_sourcetype_rename]
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::venafi_tpp
REGEX = (.)

According to the Splunk documentation it is a source-matching pattern

source::, where is the source, or source-matching pattern, for an event.

This is what I have to work with

source = Venafi Trust Protection Platform
sourcetype = Venafi TPP Log Event

Any ideas on how I can use source to reset sourcetype?

TIA,
Joe

Re: Changing the sourcetype to remove spaces

maciep — Sat, 18 Jan 2020 14:34:36 GMT

have you tried just putting the spaces in the source:: stanza? Not sure if you need regex there or why splunk wouldn't be able to handle spaces...but i've never tried.

Also, how is the data getting sent into Splunk...and is there a reason the sourcetype can't just be set there? I'm a little confused on the Rest API and the Windows UF part of the scenario...but likely it could be set at input time?

Re: Changing the sourcetype to remove spaces

woodcock — Sat, 18 Jan 2020 19:20:31 GMT

Whatever you were doing in pre-prod should work fine in production, you just need to deploy it to your Indexer (or HF) tier.

Re: Changing the sourcetype to remove spaces

jwhughes58 — Mon, 20 Jan 2020 18:40:31 GMT

The data is ingested by Splunk via the RestAPI. Unfortunately the application sets the sourcetype before sending the messages and the sourcetype can't be changed in the application UI.

Re: Changing the sourcetype to remove spaces

jwhughes58 — Mon, 20 Jan 2020 18:41:15 GMT

What I wound up doing was using source=Venafi* since Venafi only has the one feed.