All Apps and Add-ons

Splunk for Juniper SA Not picking up sourcetype

hartfoml
Motivator

I have the Juniper device sending to syslog-NG and I am reading the file as a monitored input to splunk.

I created a PROPS.conf like below in the local directory in the Juniper SA app:

### Transform Juniper SA Log SourceType
[source::/mnt/log/128.157.91.130/messages]
TRANSFORMS-sasourcetype= sa_sourcetypersouce
[source::/mnt/data/log/remote/r2s-my.server.com/messages]
TRANSFORMS-sasourcetype= sa_sourcetypersource

Do I need to create a transforms.conf in the local directory?
do I need to escape the "/" like this "//"

Tags (1)
0 Karma

grijhwani
Motivator

You appear to have a typo in your first source ("sa_sourcetypersouce" should presumably be "sa_sourcetypersource").

You should not need to escape the slashes.

You can create the transform definition wherever you consider appropriate, but if it is specific to the app then the app directory is the obvious place.

0 Karma

hartfoml
Motivator

great thanks: i did correct the typo of which I had a few.

Still not getting the sourcetype "juniper_sa_log"

I have the props.conf in the local directory and the transforms.conf in the default directory. Do you think this is the problem? since this is a search time transform I should not have to restart anything? Do you think i need to add the "priority=" value?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!