Splunk for Juniper SA Not picking up sourcetype

[hartfoml]

I have the Juniper device sending to syslog-NG and I am reading the file as a monitored input to splunk.

I created a PROPS.conf like below in the local directory in the Juniper SA app:

### Transform Juniper SA Log SourceType
[source::/mnt/log/128.157.91.130/messages]
TRANSFORMS-sasourcetype= sa_sourcetypersouce
[source::/mnt/data/log/remote/r2s-my.server.com/messages]
TRANSFORMS-sasourcetype= sa_sourcetypersource

Do I need to create a transforms.conf in the local directory?
do I need to escape the "/" like this "//"

[grijhwani]

You appear to have a typo in your first source ("sa_sourcetypersouce" should presumably be "sa_sourcetypersource").

You should not need to escape the slashes.

You can create the transform definition wherever you consider appropriate, but if it is specific to the app then the app directory is the obvious place.

[hartfoml]

great thanks: i did correct the typo of which I had a few.

Still not getting the sourcetype "juniper_sa_log"

I have the props.conf in the local directory and the transforms.conf in the default directory. Do you think this is the problem? since this is a search time transform I should not have to restart anything? Do you think i need to add the "priority=" value?