topic Re: How to reset sourcetype and do field extractions using props.conf and/or transforms.conf? in Splunk Search

How to reset sourcetype and do field extractions using props.conf and/or transforms.conf?

deepak02 — Mon, 15 May 2017 18:03:21 GMT

My Splunk setup has 3 layers,

Forwarders - 50+
Indexers - 4, running on different machines
Search Heads - 3, running on different machines

Question 1: Resetting the sourcetype
Logs are being assigned the sourcetype set in inputs.conf of the forwarders. I want to change it to a different sourcetype.

Since the forwarders are being owned by a different team and they are not willing to make changes, I will need to reset the sourcetype using props.conf and transforms.conf.

Can I reset the sourcetype at the Search Head? Or should I do it at the indexer? - Which is better?

Question 2: Fields extractions
I need to extract four fields using props.conf.
Can I do these extractions at the Search Head (the preferred option)? Or should I do it at the indexer only?

Note: I am using Splunk Enterprise

Thanks,
Deepak

Re: How to reset sourcetype and do field extractions using props.conf and/or transforms.conf?

alemarzu — Mon, 15 May 2017 19:11:31 GMT

Hello @deepak02

A) For sourcetype renaming you can do this.
Add to your props.conf on your indexer/s.

[your_sourcetype]
TRANSFORMS-sourcetype_renaming = renaming_old_sourcetype

Add to your transforms.conf on your indexer/s.

[renaming_old_sourcetype]
SOURCE_KEY = MetaData:Source
REGEX = <regex matching your source of events>
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::<new_sourcetype>

B) You should read this pages of Splunk documentation: http://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#When_to_use_inline_or_transform_extractions

Hope it helps.

Re: How to reset sourcetype and do field extractions using props.conf and/or transforms.conf?

woodcock — Wed, 17 May 2017 01:43:23 GMT

Resetting it at the Indexer is "better" because it actually changes the sourcetype but you can also pretend that the sourcetype has been changed and refer to it by a new name by using the sourcetype rename configuration on the Search Head:

https://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Renamesourcetypes