All Apps and Add-ons

Splunk for Juniper SA Not picking up sourcetype


I have the Juniper device sending to syslog-NG and I am reading the file as a monitored input to splunk.

I created a PROPS.conf like below in the local directory in the Juniper SA app:

### Transform Juniper SA Log SourceType
TRANSFORMS-sasourcetype= sa_sourcetypersouce
TRANSFORMS-sasourcetype= sa_sourcetypersource

Do I need to create a transforms.conf in the local directory?
do I need to escape the "/" like this "//"

Tags (1)
0 Karma


You appear to have a typo in your first source ("sa_sourcetypersouce" should presumably be "sa_sourcetypersource").

You should not need to escape the slashes.

You can create the transform definition wherever you consider appropriate, but if it is specific to the app then the app directory is the obvious place.

0 Karma


great thanks: i did correct the typo of which I had a few.

Still not getting the sourcetype "juniper_sa_log"

I have the props.conf in the local directory and the transforms.conf in the default directory. Do you think this is the problem? since this is a search time transform I should not have to restart anything? Do you think i need to add the "priority=" value?

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...