All Apps and Add-ons

[Splunk_TA_nix] Search Time field extraction (host_as_src) replaces existing src values with host value

Masa
Splunk Employee
Splunk Employee

[Splunk_TA_nix] Search Time field extraction (host_as_src) replaces existing src values with host value.

I have syslog events forwarded to udp:514. The event contains "src=<IP address>" string. So, Splunk automatically extract src fields correctly. I had over 100 of IP addresses as src.
As soon as I installed Splunk_TA_nix, src value became only one which is same as host value.

What is a solution to resolve this issue?

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Splunk's ability to correctly tag and extract data is compromised if sourcetypes aren't used properly. Putting all of your stuff into one sourcetype (which is implied by using a single receiving port for multiple types of things) is a bad idea.

Said another way, if you take any two TA's you're going to find overlapping extractions for common things like src and dest. They will probably have conflicts if you don't use sourcetype to keep them separated.

View solution in original post

Masa
Splunk Employee
Splunk Employee

Splunk_TA_nix is setting REPORT-src_for_syslog for syslog sourcetype. This attribute includes host_as_src search time field extraction. The host_as_src is setting host value as src value and overriding src value if it is already exist.

Here is the part causing this issue.


[syslog]
REPORT-src_for_syslog = src_dns_as_src, src_ip_as_src, host_as_src

So, potential workaround is to set a host stanza to override REPORT settings in Splunk_TA_nix add-on.

Here is an example; Assuming host value


$SPLUNK_HOME/etc/apps/Splunk_TA_nix/local/props.conf
[host::10.10.10.*]
REPORT-src_for_syslog = src_dns_as_src, src_ip_as_src

Other solution is to use a different udp port and then assign a different sourcetype ( not syslog sourcetype ) so that Splunk_TA_nix will not affect your events.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Splunk's ability to correctly tag and extract data is compromised if sourcetypes aren't used properly. Putting all of your stuff into one sourcetype (which is implied by using a single receiving port for multiple types of things) is a bad idea.

Said another way, if you take any two TA's you're going to find overlapping extractions for common things like src and dest. They will probably have conflicts if you don't use sourcetype to keep them separated.

Masa
Splunk Employee
Splunk Employee

I agree with general practice; how we should make use of sourcetype to separate events based on different type of events.

When it comes to syslog sourcetype it is a challenge.

0 Karma

Masa
Splunk Employee
Splunk Employee

syslog sourcetype could be used so many different event formats. Why Splunk_TA_nix assume event does not have src field in raw data?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...