All Apps and Add-ons

All data is indexing as sophos:xg:IDP

New Member

I have configured our XG to push all syslog data to a syslog-ng collector, from there I have the splunk forwarder set to forward all data from the log to my indexer as sourcetype = sophos:xg:syslog

However, everything is logging on the indexer as sourcetype sophos:xg:IDP even though we have all syslog data forwarding from the firewall. Is there something I need to change on inputs.conf or outputs.conf of the indexer or forwarder to make this function properly?

I have installed the add-on on both the indexer and the forwarder and restarted splunk on both.

0 Karma

Builder

Hi jeffmec,

I haven't seen the app itself, but from the symptoms you describe I'd bet that the app does some internal routing of events. Check the app's (or corresponding TA's) transforms.conf on the indexer for some stanzas that do sourcetpye rewriting based on regular expressions:

[some_stanza_name]
REGEX = ^.*someregex.*
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::sophos:xg:IDP

Detailed info on the topic: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

Best
Oliver

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!