All Apps and Add-ons

help using transforms to change sourcetype from netflow


hi, i've been trying for a long time now to get netscaler ipfix/netflow data properly ingested into a Nozo9110test splunk instance.

I have the stream app and forwarder etc looking like they are working. all  the data comes in as sourcetype stream:netflow. however i need this to be sourcetype citrix:netscaler:ipfix. so i have added props and transforms to achieve that based on the ip address the data is coming from. now this has worked and the sourcetype has changed as you can see:



however, i expected the data to then be processed and the fields extracted from the netscalersyslogmessage field. in the netscaler TA there are entries to transform sourcetype on the detection of netscalerSyslogMessage but none of that seems to be happening.

i'm sure i'm just missing something obvious but i'd really appreciate some help nailing this down.


here's what i've done to change the sourcetype:


TRANSFORMS-changesourcetype = set_netscaler



FORMAT = sourcetype::citrix:netscaler:ipfix
DEST_KEY = MetaData:Sourcetype
REGEX= exporter_ip":"

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...