Sourcetyping DHCPD logs out of var/log/messages

[jcooperFossil]

Utilizing Splunk Cloud

I'm using the Splunk TA Nix app on all my linux servers. Additionally running Splunk Add On for ISC DHCPD on the DHCP servers.

Other than adjusting syslog to write dhcp logs to a new file (which is my preferred way, but running into red tape), how can I have the DHCPD logs be sourcetyped properly?

They're currently going in to /var/log/messages and being picked up by the Splunk TA Nix app and going into the "os" index.

I'd prefer to send them to their own index too, if that is possible.

[kmorris_splunk]

You can route events to different indexes or sourcetypes using props.conf and transforms.conf files on the indexer(s). Here is an example of both, using host as the key. You could also base this on source or sourcetype in props.

**props.conf**
[mycosyslog]
TRANSFORMS-setst = setst_ace, setst_pan
TRANSFORMS-setindex = setindex_pan

**transforms.conf**
[setst_ace]
SOURCE_KEY = MetaData:Host
DEST_KEY = MetaData:Sourcetype
REGEX = [YOUR REGEX HERE]
FORMAT = sourcetype::cisco:ace

[setst_pan]
SOURCE_KEY = MetaData:Host
DEST_KEY = MetaData:Sourcetype
REGEX =  [YOUR REGEX HERE]
FORMAT = sourcetype::pan_log

[setst_ace]
SOURCE_KEY = MetaData:Host
DEST_KEY = _MetaData:Index
REGEX =  [YOUR REGEX HERE]
FORMAT = pan_logs

[kmorris_splunk]

Just realizing you indicated Splunk Cloud. This change would require a ticket to get Cloud Ops to put the props.conf and transforms.conf changes in place for you.

[jcooperFossil]

So I couldn't make that change on the Heavy Forwarder or on the UF?