How to change assigned sourcetype for Add-on for Unix and Linux from syslog

[ejwade]

We have the Splunk Add-on for Unix and Linux installed on a deployment server, and pushed out to many Linux hosts. Currently, we're having issues with the following stanza in the inputs.conf file:

[monitor:///var/log]
whitelist=(.log|log$|messages|secure|auth|mesg$|cron$|acpid$|.out)
blacklist=(lastlog|anaconda.syslog)
index=os
disabled = 0

This directory is monitored using universal forwarders, and sent to indexers to be parsed. At some point, the sourcetype "syslog" is given to this log data. Is this common? I thought I'd seen /var/log/message as sourcetype="messages" in the past.

[micahkemp]

Check to see if you have the appropriate tag values for the events with the syslog sourcetype. As long as those are correct, the CIM should be just fine with that data. The CIM doesn't (by default) care about sourcetypes.

[ejwade]

You're correct. And the corresponding App expecting the sourcetype=syslog. Thanks for your help, @micahkemp.

[micahkemp]

Which values do you see for source for the sourcetype syslog? That is indeed a common sourcetype, but I'm not sure all of those files should have that sourcetype in the end. The app's props.conf sets different sourcetypes based on the filename.

I don't see any reference to a messages sourcetype in the TA.

[ejwade]

I see the filepath for the log (e.g., /var/log/messages) as the source, but the sourcetype gets tagged as "syslog". You're correct - the TA documentation does not specify messages sourcetype, but I was surprised to see "syslog". Curious if this was expected behavior, and whether it works with the App and CIM.