topic How to define a source type in Splunk Search

How to define a source type

ethanthomas — Tue, 13 Apr 2021 20:51:13 GMT

I have a requirement to add new data format to splunk . Below is the sample data . If i want to setup a new sourcetype based on the field 'InputType', what are the changes required in the props.conf file and transforms.conf file ? I want the sourcetype to display the values aMG, zRP or bKL

Sample data

InputType="aMG"|filename <K............

InputType="zRP"{dataformat..>...........

InputType="bKL"$%mo << ........

InputType="aMG"\dataformat.......

Re: How to define a source type

scelikok — Wed, 14 Apr 2021 03:55:10 GMT

Hi @ethanthomas,

Below should work for you, please input_sourcetype stanza with yours.

transforms.conf [update_sourcetype] REGEX = InputType=\"([^\"]+) FORMAT = sourcetype::$1 DEST_KEY = MetaData:Sourcetype props.conf [input_sourcetype] TRANSFORMS-sourcetype_override = update_sourcetype

For reference your can check below docs link;

https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Advancedsourcetypeoverrides#Override_source_types_on_a_per-event_basis

Re: How to define a source type

ethanthomas — Mon, 19 Apr 2021 22:30:37 GMT

I have used exactly the same . However , the sourcetype is still the value defined in the input.conf file . Any issues ? Do i need to change anything in the input .conf file ? I removed the sourcetype in the Input.conf file , but on that case the sourcetype changes to the default value tcp-raw. Please help

Re: How to define a source type

scelikok — Wed, 21 Apr 2021 03:33:33 GMT

You should put a sourcetype in your inputs.conf. Did you put these props and transforms to indexers? Or if there is a Heavy Forwarder between, you have to put it there. Could you please share your props, transforms and inputs.conf settings? Also infor about your setup, UF, HF and indexers.