All Apps and Add-ons

Splunk for Juniper SA Not picking up sourcetype


I have the Juniper device sending to syslog-NG and I am reading the file as a monitored input to splunk.

I created a PROPS.conf like below in the local directory in the Juniper SA app:

### Transform Juniper SA Log SourceType
TRANSFORMS-sasourcetype= sa_sourcetypersouce
TRANSFORMS-sasourcetype= sa_sourcetypersource

Do I need to create a transforms.conf in the local directory?
do I need to escape the "/" like this "//"

Tags (1)
0 Karma


You appear to have a typo in your first source ("sa_sourcetypersouce" should presumably be "sa_sourcetypersource").

You should not need to escape the slashes.

You can create the transform definition wherever you consider appropriate, but if it is specific to the app then the app directory is the obvious place.

0 Karma


great thanks: i did correct the typo of which I had a few.

Still not getting the sourcetype "juniper_sa_log"

I have the props.conf in the local directory and the transforms.conf in the default directory. Do you think this is the problem? since this is a search time transform I should not have to restart anything? Do you think i need to add the "priority=" value?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!