Splitting of sourcetype

rahulg — Mon, 15 Feb 2021 17:18:35 GMT

Hello there

I am monitoring files using input.conf and define source source type there

i am trying to split sourcetype in to multiple sourcetype

inputs.conf

[monitor:///opt/splunk/etc/apps/out/bin/out/.../*.gz]
disabled=0
index=security_abc_index
sourcetype=abd_s3
source=abd
interval=60

this props.conf here i am doing parsing

[abd_s3]
LINE_BREAKER = ""{"
NO_BINARY_CHECK = 1
TRUNCATE = 0
SHOULD_LINEMERGE = false
TRANSFORMS-splitsourcetype = event1, event2, event3, event4

and TRANSFORMS.conf, event2, 3, 4 are having regex which i want to put in source type , everything else which is not matching to regex to event1

[event1]
DEST_KEY = MetaData:Sourcetype
REGEX = .
FORMAT = sourcetype::event1

[event2]
DEST_KEY = MetaData:Sourcetype
REGEX = \{\"AgentLoadFlags\".*
FORMAT = sourcetype::event2

[event3]
DEST_KEY = MetaData:Sourcetype
REGEX = \{\"GatewayIP\".*
FORMAT = sourcetype::event3

[event4]
DEST_KEY = MetaData:Sourcetype
REGEX= \{\"ComputerName\".*
FORMAT = sourcetype::event4

Output in index i am getting in to sourcetype event1 which not macthing to regex

which ever matched to regex not getting monitored not even index, am i doing anything wrong

Re: Splitting of sourcetype

richgalloway — Mon, 15 Feb 2021 19:11:53 GMT

The regex in the [event1] transform matches everything. That's why everything is in that sourcetype. Try changing the order in the TRANSFORMS attribute.

TRANSFORMS-splitsourcetype = event2, event3, event4, event1

Re: Splitting of sourcetype

rahulg — Tue, 16 Feb 2021 17:14:43 GMT

Thank you

topic Splitting of sourcetype in Getting Data In

Splitting of sourcetype

Re: Splitting of sourcetype

Re: Splitting of sourcetype