https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113100#M29710 <P>2 thoughts depending on how your environment is setup. Out of curiosity have you restarted your indexer(s) after making your change or the one proposed to somesoni2? If that data is being handled by a heavy forwarder the props/transforms will need to be pushed to it.</P> Tue, 19 May 2015 11:09:43 GMT Runals 2015-05-19T11:09:43Z https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113098#M29708 <P>I am trying to make a minor update to take some data that is coming in via syslog and change the sourcetype to infoblox_dns and the move it to the network index but having issues getting splunk to recognize it. What am I doing wrong!?</P> <PRE><CODE>transforms.conf: [mc_force_sourcetype_for_infoblox_dns] REGEX = (\d+\.\d+\.\d+\.\d+\s(named|dhcpd|lbsyncd|lbsync_f5)|\[\d+\]\:|\d+\.\d+\.\d+\.\d+\s(lbsync_f5|Available\sLeases|Total\sAddresses|Active\sLeases|Current\sUsage|High\sReset\sMark|High\sTrigger\sMark|Low\sReset\sMark|Low\sTrigger\sMark|Range|Network|Member|kernel|serial_console|/infoblox/one/bin/rotate_syslog)\:) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::infoblox_dns [mc_force_index_for_infoblox_dns] SOURCE_KEY = MetaData:Sourcetype REGEX = (infoblox_dns) DEST_KEY = _MetaData:Index FORMAT = network Props.conf: [syslog] TIME_FORMAT = %b %d %H:%M:%S TIME_PREFIX = ^ SHOULD_LINEMERGE = false TRUNCATE = 1000000 KV_MODE = none ANNOTATE_PUNCT = false LINE_BREAKER = ([\n\r]+) TRANSFORMS-2_syslog_sourcetypes = mc_force_sourcetype_for_infoblox_dns TRANSFORMS-3_syslog_index = mc_force_index_for_infoblox_dns [splunk@host ~]$ splunk cmd btool transforms list --debug | grep infoblox | less /opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf [mc_force_index_for_infoblox_dns] /opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf REGEX = (infoblox_dns) /opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf [mc_force_sourcetype_for_infoblox_dns] /opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf FORMAT = sourcetype::infoblox_dns /opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf REGEX = (\d+\.\d+\.\d+\.\d+\s(named|dhcpd|lbsyncd|lbsync_f5)|\[\d+\]\:|\d+\.\d+\.\d+\.\d+\s(lbsync_f5|Available\sLeases|Total\sAddresses|Active\sLeases|Current\sUsage|High\sReset\sMark|High\sTrigger\sMark|Low\sReset\sMark|Low\sTrigger\sMark|Range|Network|Member|kernel|serial_console|/infoblox/one/bin/rotate_syslog)\:) </CODE></PRE> Mon, 18 May 2015 20:10:47 GMT https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113098#M29708 LiquidTension 2015-05-18T20:10:47Z https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113099#M29709 <P>Try this in your transforms.conf</P> <PRE><CODE> [mc_force_sourcetype_for_infoblox_dns] REGEX = (\d+\.\d+\.\d+\.\d+\s(named|dhcpd|lbsyncd|lbsync_f5)|\[\d+\]\:|\d+\.\d+\.\d+\.\d+\s(lbsync_f5|Available\sLeases|Total\sAddresses|Active\sLeases|Current\sUsage|High\sReset\sMark|High\sTrigger\sMark|Low\sReset\sMark|Low\sTrigger\sMark|Range|Network|Member|kernel|serial_console|/infoblox/one/bin/rotate_syslog)\:) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::infoblox_dns [mc_force_index_for_infoblox_dns] REGEX = (\d+\.\d+\.\d+\.\d+\s(named|dhcpd|lbsyncd|lbsync_f5)|\[\d+\]\:|\d+\.\d+\.\d+\.\d+\s(lbsync_f5|Available\sLeases|Total\sAddresses|Active\sLeases|Current\sUsage|High\sReset\sMark|High\sTrigger\sMark|Low\sReset\sMark|Low\sTrigger\sMark|Range|Network|Member|kernel|serial_console|/infoblox/one/bin/rotate_syslog)\:) DEST_KEY = _MetaData:Index FORMAT = network </CODE></PRE> Mon, 18 May 2015 21:14:58 GMT https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113099#M29709 somesoni2 2015-05-18T21:14:58Z https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113100#M29710 <P>2 thoughts depending on how your environment is setup. Out of curiosity have you restarted your indexer(s) after making your change or the one proposed to somesoni2? If that data is being handled by a heavy forwarder the props/transforms will need to be pushed to it.</P> Tue, 19 May 2015 11:09:43 GMT https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113100#M29710 Runals 2015-05-19T11:09:43Z https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113101#M29711 <P>I did issue a rolling restart command after pushing the change via the cluster master and that did not resolve the problem. I will give somesoni2's suggest a shot here later today.</P> Tue, 19 May 2015 15:13:39 GMT https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113101#M29711 LiquidTension 2015-05-19T15:13:39Z https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113102#M29712 <P>This unfortunately did not work either after making the change and restarting the indexers. The data is still coming in<BR /><BR /> index=main, sourcetype=syslog</P> Tue, 19 May 2015 18:54:11 GMT https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113102#M29712 LiquidTension 2015-05-19T18:54:11Z https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113103#M29713 <P>Any other ideas or something standing out that I am doing wrong? </P> Tue, 26 May 2015 13:52:03 GMT https://community.splunk.com/t5/Splunk-Search/Transform-for-sourcetype-issue/m-p/113103#M29713 LiquidTension 2015-05-26T13:52:03Z