All data is indexing as sophos:xg:IDP

[jeffmec]

I have configured our XG to push all syslog data to a syslog-ng collector, from there I have the splunk forwarder set to forward all data from the log to my indexer as sourcetype = sophos:xg:syslog

However, everything is logging on the indexer as sourcetype sophos:xg:IDP even though we have all syslog data forwarding from the firewall. Is there something I need to change on inputs.conf or outputs.conf of the indexer or forwarder to make this function properly?

I have installed the add-on on both the indexer and the forwarder and restarted splunk on both.

[ololdach]

Hi jeffmec,

I haven't seen the app itself, but from the symptoms you describe I'd bet that the app does some internal routing of events. Check the app's (or corresponding TA's) transforms.conf on the indexer for some stanzas that do sourcetpye rewriting based on regular expressions:

[some_stanza_name]
REGEX = ^.*someregex.*
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::sophos:xg:IDP

Detailed info on the topic: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

Best
Oliver