topic Re: what is the difference between override source type from forwarder and from indexer??? in Knowledge Management

what is the difference between override source type from forwarder and from indexer???

ahmedragy922 — Sat, 08 Jun 2019 13:55:40 GMT

Hi,
i'm new to splunk , i just wounder what is the difference between override source type/index from forwarder and from indexer???
and also if i choose to override sourcetype of files in universal forwarder , should i create a sourcetype and regex in transforms.conf on Search head with the new name that i specified in Universal Forwarder inputs.conf file to extract fields???

Re: what is the difference between override source type from forwarder and from indexer???

VatsalJagani — Sun, 09 Jun 2019 06:41:29 GMT

@ahmedragy922,

There are three ways some ways you can attach sourcetype to your event. you should not worry about its difference as for user when you search the data there its just one sourcetype statically attached to your event + props/transforms regarding sourcetype will not apply on universal forwarder it will apply on Indexer.

If you write sourcetype in inputs.conf that will be applied from universal forwarder. Then data come to Indexer (it is called parsing phase but, if you use heavy forwarder parsing phase will be on Heavy Forwarder. Universal forwarder cannot perform parsing phase), there you can override that value with sourcetype parameter in props.conf or you can also override its value with Meta field from transforms.conf.

I hope this gives you the understanding that you need about sourcetype.

Re: what is the difference between override source type from forwarder and from indexer???

ahmedragy922 — Sun, 09 Jun 2019 11:41:30 GMT

thank you for your reply , but if i want to dynamically identify the sourcetype of data the are coming to indexer from forwarder , in this case i need to modify props.conf in indexer (parsing phase) to create regex matching the data and gives it a sourcetype ???

Re: what is the difference between override source type from forwarder and from indexer???

VatsalJagani — Sun, 09 Jun 2019 14:18:37 GMT

props.conf

[<some stanza>]
TRANSFORMS-change_sourcetype = change_sourcetype_tr

transforms.conf

[change_sourcetype_tr]
REGEX = <regex to identify events for which you want to change sourcetype for>
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::<new sourcetype you want to assign>

Re: what is the difference between override source type from forwarder and from indexer???

ahmedragy922 — Tue, 11 Jun 2019 13:47:00 GMT

thank you