topic Re: transforms.conf and props.conf in Splunk Search

transforms.conf and props.conf

jtran9373 — Tue, 25 Feb 2025 19:48:17 GMT

my event and inputs.conf

sourcetype = rsa:syslog

feb 01 10:24:12 myhostname 2025-02-01 10:24:12,999, myhostname, audit.admin.com.cd.etc info

my props.conf

[rsa:syslog]

TRANSFORMS-change_sourcetype = change_sourcetype

my transforms.conf

[change_sourcetype]

DESK_KEY = MetaData:Sourcetype

SOURCE_KEY = MetaData:Sourcetype

REGEX = \,\s+adudit\.admin

FORMAT = sourcetype::new:sourcetype

could anyone help? my sourcetype doesn't change to "new:sourcetype"

thank you

Re: transforms.conf and props.conf

livehybrid — Tue, 25 Feb 2025 21:12:40 GMT

Hi @jtran9373

You are using "SOURCE_KEY = MetaData:Sourcetype" to match for the regex string, however your sourcetype is "rsa:syslog" ?

It looks like you might be meaning to use SOURCE_KEY = _raw (which is the default) to match your REGEX string against the sample event you provided.

Try removing the SOURCE_KEY key/value pair from your props.conf and see if that resolves your issue.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: transforms.conf and props.conf

jtran9373 — Wed, 26 Feb 2025 13:44:59 GMT

"rsa:syslog" is sourcetype, and I want to change to another sourcetype.
I will try with SOURCE_KEY = _raw.

thank you for your help

Re: transforms.conf and props.conf

jtran9373 — Wed, 26 Feb 2025 16:15:32 GMT

feb 01 10:24:12 myhostname 2025-02-01 10:24:12,999, myhostname, audit.admin.com.cd.etc info

feb 01 10:24:12 myhostname 2025-02-01 10:24:12,999, myhostname, audit.system.com.cd.etc info

inputs.conf

sourcetype = rsa:syslog

my props.conf

I would like to change sourcetype base "admin", OR "system" depend on raw events.

[rsa:syslog]

TRANSFORMS-change_sourcetype = change_admin_sourcetype, change_system_sourcetype

my transforms.conf

[change_admin_sourcetype]

DESK_KEY = MetaData:Sourcetype

REGEX = \,\s+adudit\.admin

FORMAT = sourcetype::rsa:admin

[change_system_sourcetype]

DESK_KEY = MetaData:Sourcetype

REGEX = \,\s+adudit\.system

FORMAT = sourcetype::rsa:system

but it doesnt' work.

thank you for your help.

Re: transforms.conf and props.conf

livehybrid — Wed, 26 Feb 2025 16:17:47 GMT

Hi @jtran9373

You have put "adudit" in your regex, not "audit" - is this typo in Splunk too or just on here? This might explain you issue.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: transforms.conf and props.conf

jtran9373 — Wed, 26 Feb 2025 16:49:00 GMT

sorry, it was my typo here.

in my my transforms.conf is "\,\s+aduit\.admin

thank you for catching that.

Re: transforms.conf and props.conf

jtran9373 — Wed, 26 Feb 2025 16:50:26 GMT

feb 01 10:24:12 myhostname 2025-02-01 10:24:12,999, myhostname, audit.admin.com.cd.etc info

feb 01 10:24:12 myhostname 2025-02-01 10:24:12,999, myhostname, audit.system.com.cd.etc info

inputs.conf

sourcetype = rsa:syslog

my props.conf

I would like to change sourcetype base "admin", OR "system" depend on raw events.

[rsa:syslog]

TRANSFORMS-change_sourcetype = change_admin_sourcetype, change_system_sourcetype

my transforms.conf

[change_admin_sourcetype]

DESK_KEY = MetaData:Sourcetype

REGEX = \,\s+auddit\.admin

FORMAT = sourcetype::rsa:admin

[change_system_sourcetype]

DESK_KEY = MetaData:Sourcetype

REGEX = \,\s+auddit\.system

FORMAT = sourcetype::rsa:system

Re: transforms.conf and props.conf

jtran9373 — Thu, 27 Feb 2025 14:28:19 GMT

issues had been resolved.

I did the props.conf and transforms.conf on the search heads alone, it didn't work.
I also both props.conf and transforms.conf on the heavyforwarder, then it works.

thank you for your helps!!!