All Apps and Add-ons

Configuring TA: Why is Tomato change index not working?

WollyCGN
Explorer

Hello community,

first I have to say that I'm very,very new to Splunk. Getting to Splunk is because of a solution I found in the streamboard community about analysis of OSCam logs.
So I've installed Splunk on ubuntu and the OSCam-App from 'jotne' - works nice.

Now knowing what Splunk does I thought about to analyse my routers syslog as well and came up with the TA-Tomato app.
So I configured my router to send the syslog data to the UDP port like OSCam does. Data is stored in index = main; sourcetype = syslog - GREAT!

Now I came to the very easy things mentioned in the README:
- Please onboard your data as sourcetype=tomato
- This app also assumes your data will exist in index=tomato

This maybe is no issue for someone who is familiar with Splunk but for me it isn't.
After two days of reading, trying to understand and testing, I didn't get this to work.

I played around with some configuration I found here: https://community.splunk.com/t5/All-Apps-and-Add-ons/Unable-to-get-working-with-Tomato/m-p/223350
and ended with copy the files app.conf, props.conf, transforms.conf to the local directory. (is it right if a file exists in the local dir the one in default is ignored? - think so but dont know)

I insert:

 

[host::192.168.0.1]
TRANSFORMS-tomato = set_index_tomato,set_subtype_tomato

 

to the top of probs.conf

and this:

 

[set_index_tomato}
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = tomato

[set_subtype_tomato]
REGEX = 192.168.0.1
SOURCE_KEY = MetaData:Host
FORMAT = sourcetype::tomato
DEST_KEY = MetaData:Sourcetype

 

to the top of transforms.conf

Sourcetype will work but index is still 'main'.
So, what's wrong with my stupid idea.

Thanks

Labels (2)
0 Karma
1 Solution

WollyCGN
Explorer

found a solution by myself

I've added this into the /system/local/inputs.conf

[udp://192.168.0.1:514]
sourcetype = tomato
index = tomato

View solution in original post

WollyCGN
Explorer

found a solution by myself

I've added this into the /system/local/inputs.conf

[udp://192.168.0.1:514]
sourcetype = tomato
index = tomato
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...