Utilizing Splunk Cloud
I'm using the Splunk TA Nix app on all my linux servers. Additionally running Splunk Add On for ISC DHCPD on the DHCP servers.
Other than adjusting syslog to write dhcp logs to a new file (which is my preferred way, but running into red tape), how can I have the DHCPD logs be sourcetyped properly?
They're currently going in to /var/log/messages and being picked up by the Splunk TA Nix app and going into the "os" index.
I'd prefer to send them to their own index too, if that is possible.
You can route events to different indexes or sourcetypes using props.conf and transforms.conf files on the indexer(s). Here is an example of both, using host as the key. You could also base this on source or sourcetype in props.
**props.conf** [mycosyslog] TRANSFORMS-setst = setst_ace, setst_pan TRANSFORMS-setindex = setindex_pan **transforms.conf** [setst_ace] SOURCE_KEY = MetaData:Host DEST_KEY = MetaData:Sourcetype REGEX = [YOUR REGEX HERE] FORMAT = sourcetype::cisco:ace [setst_pan] SOURCE_KEY = MetaData:Host DEST_KEY = MetaData:Sourcetype REGEX = [YOUR REGEX HERE] FORMAT = sourcetype::pan_log [setst_ace] SOURCE_KEY = MetaData:Host DEST_KEY = _MetaData:Index REGEX = [YOUR REGEX HERE] FORMAT = pan_logs
Just realizing you indicated Splunk Cloud. This change would require a ticket to get Cloud Ops to put the props.conf and transforms.conf changes in place for you.