Splunk for Barracuda Web Application Firewall: Is it OK to change the input source to a new UDP port and sourcetype?

[spldalya]

I have my WAF data coming in over a different UDP port with it's own sourcetype. If I change the inputs.conf file to reflect my port and source type, will the app just pick this up when I add the inputs.conf file to the local directory?

Thanks

[jeffland]

After a splunk restart, it should.

Keep in mind that if you change the sourcetype, your predefined reports/views might not work if they contain a search for the default sourcetype.

[spldalya]

Hi

Thanks for your reply. This is possibly a wider issue with taking in Syslog data from multiple sources and how I, in an attempt to source type the data, have created multiple input sources on udp so now this app is looking for syslog data on the standard port. I thought I could just change the inputs.conf file for the app to point to the unique port. But the transforms do not appear to be working. Any idea how to "debug" an app to see what's actually going on between input and transforms?
Thanks

[jeffland]

You'll have to look through the conf files, most notably props.conf (and possibly transforms.conf). Or, if available, check the app's documentation.

Have you tried editing only the port in inputs.conf, without changing any sourcetype assignments? That could save you the hassle.