topic Re: Sourcetype not changing for windows application logs in Getting Data In

Sourcetype not changing for windows application logs

jericksonpf — Wed, 28 Aug 2013 21:52:38 GMT

I have a universal forwarder sending the application logs for a windows 2003 server we have that only runs one application.

Here is what my inputs.conf stanza looks like:

[WinEventLog:Application]
index=radical_index
sourcetype=bizznezz

However the logs show up in splunk as WinEventLog:Application no matter how many times i restart the service.

Interestingly as a test i changed the hostname on the inputs.conf and that change was immediately reflected

Re: Sourcetype not changing for windows application logs

lukejadamec — Wed, 28 Aug 2013 22:19:37 GMT

What windows related apps do you have installed on the forwarder and indexer?

Also, is the sourcetype bizznezz populated with the data?

Re: Sourcetype not changing for windows application logs

jericksonpf — Wed, 28 Aug 2013 22:25:59 GMT

yes they are receiving events. These are biztalk logs

Re: Sourcetype not changing for windows application logs

lukejadamec — Wed, 28 Aug 2013 23:57:55 GMT

It sounds like one of your other apps is mining data and tagging it with the windows application source type.

If your bizznezz sourcetype has data, then you really are asking how to stop the other apps from also sourcetyping this data.

Re: Sourcetype not changing for windows application logs

jericksonpf — Wed, 04 Sep 2013 18:32:17 GMT

where do i check whcih apps are sourcetyping? do i have to looks at the props.conf for each app? Doesn't splunk itself autmatically generate fields

Re: Sourcetype not changing for windows application logs

lukejadamec — Wed, 04 Sep 2013 18:55:00 GMT

I'm pretty sure the stanza you're looking for is in splunk/etc/apps/windows/default/eventgen/transforms.conf
But I don't know how to change it to make it stop tagging your logs.
I still don't really understand, why is it a problem to have them all tagged with the application sourcetype?