I'm trying to do an override using an added source to props.conf (in the default directory for the app) but it is not working:
[source::\\anchqqsw108m\logs\(\w{6}-asa\d-?(outside|inside|ncic|wifi)?).*]
TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm
Here are examples of the source:
\anchqqsw108m\logs\anchqq-asa1-outside\2014-05-22\daily-syslog.txt
\anchqqsw108m\logs\anchqq-asa1-inside\2014-05-22\daily-syslog.txt
\anchqqsw108m\logs\anchqq-asa5-wifi\2014-05-22\daily-syslog.txt
\anchqqsw108m\logs\anchqq-asa4-ncic\2014-05-22\daily-syslog.txt
\anchqqsw108m\logs\betast-asa4\2014-05-22\daily-syslog.txt
The source type for the log monitor (\anchqqsw108m\logs) is set to automatic.
Do I have to shift the monitor source type to syslog?
example event log:
2014-05-22 13:11:49 Local4.Warning anchqq-asa1-outside May 22 2014 13:11:50: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 3 per second, max configured rate is 10; Current average rate is 13 per second, max configured rate is 5; Cumulative total count is 8224
host = anchqq-asa1-outside source = \anchqqsw108m\logs\anchqq-asa1-outside\2014-05-22\daily-syslog.txt sourcetype = daily-syslog-14
