Splunkcloud - Specify a different sourcetype for Generic S3 input ?

robot2051 — Wed, 14 Nov 2018 00:43:08 GMT

Hello,

We have iis log being stored in a S3 bucket in CSV format. My understanding is sourcetype for CSV will help parsing these events and indexing them as they come in. I would like to use our aws-add-on which includes a generic s3 input to pick up these logs and parse it with either my custom sourcetype or iis sourcetype...

First of all, Is this possible?

I have tried to create this via Splunk add-on for aws -> Input -> Create New Input -> Custom Data Type -> Generic S3 . the sourcetype drop down only has aws specific sourcetype, I could type any sourcetype name and add the input, however when i searched for these events, the events are not parsed and displayed as raw only.

I have also tried using IIS Add-on which come with a sourcetype for iis logs but that didnt work.

Please let me know if you have done it before and got it to work.

Kind regards,
Sam

Re: Splunkcloud - Specify a different sourcetype for Generic S3 input ?

robot2051 — Wed, 14 Nov 2018 02:27:23 GMT

Note: Because we are using splunkcloud , unfortunately we can't edit the actual config files as it is not managed by us 😞 Please let me know if there is a documentation or if you know how to achieve this in the UI, that would be great.

Cheers

topic Re: Splunkcloud - Specify a different sourcetype for Generic S3 input ? in Getting Data In

Splunkcloud - Specify a different sourcetype for Generic S3 input ?

Re: Splunkcloud - Specify a different sourcetype for Generic S3 input ?