[Splunk_TA_nix] Search Time field extraction (host_as_src) replaces existing src values with host value

[Masa]

[Splunk_TA_nix] Search Time field extraction (host_as_src) replaces existing src values with host value.

I have syslog events forwarded to udp:514. The event contains "src=<IP address>" string. So, Splunk automatically extract src fields correctly. I had over 100 of IP addresses as src.
As soon as I installed Splunk_TA_nix, src value became only one which is same as host value.

What is a solution to resolve this issue?

[Masa]

Splunk_TA_nix is setting REPORT-src_for_syslog for syslog sourcetype. This attribute includes host_as_src search time field extraction. The host_as_src is setting host value as src value and overriding src value if it is already exist.

Here is the part causing this issue.

[syslog]

REPORT-src_for_syslog = src_dns_as_src, src_ip_as_src, host_as_src

So, potential workaround is to set a host stanza to override REPORT settings in Splunk_TA_nix add-on.

Here is an example; Assuming host value

$SPLUNK_HOME/etc/apps/Splunk_TA_nix/local/props.conf

[host::10.10.10.*]

REPORT-src_for_syslog = src_dns_as_src, src_ip_as_src

Other solution is to use a different udp port and then assign a different sourcetype ( not syslog sourcetype ) so that Splunk_TA_nix will not affect your events.

[jcoates_splunk · Accepted solution]

Splunk's ability to correctly tag and extract data is compromised if sourcetypes aren't used properly. Putting all of your stuff into one sourcetype (which is implied by using a single receiving port for multiple types of things) is a bad idea.

Said another way, if you take any two TA's you're going to find overlapping extractions for common things like src and dest. They will probably have conflicts if you don't use sourcetype to keep them separated.

[Masa]

I agree with general practice; how we should make use of sourcetype to separate events based on different type of events.

When it comes to syslog sourcetype it is a challenge.

[Masa]

syslog sourcetype could be used so many different event formats. Why Splunk_TA_nix assume event does not have src field in raw data?