Hi,
I would like to change the sourcetype of data being received from a UDP Syslog stream via a heavy forwarder.
On the heavy forwarder I have deployed an app configured with the following:
inputs.conf:
[udp://10.1.2.3:514]
connection_host = dns
index = MyIndex
sourcetype = syslog
Data sent to the Splunk Heavy Forwarder host (Splunk version 6.4.1 running on Windows) is received by Splunk and the sourcetype, as expected is set to syslog. I would like to change the sourcetype to something more descriptive and have found if I just edit the sourcetype in the inputs.conf file data is not received (I assume setting the sourcetype to syslog effects the way Splunk behaves as it receives the data?)
So anyway I created a props.conf file with the following in:
props.conf:
[syslog]
TRANSFORMS-changesourcetype = set_sourcetype_to_MyAppUDP
and then created a transforms.conf like this:
[set_sourcetype_to_MyAppUDP]
FORMAT = sourcetype::MyApp-UDP
DEST_KEY = MetaData:Sourcetype
WRITE_META = true
I've deployed it to the heavy forwarder and am receiving data but the sourcetype is not being changed and I'm unsure why?
Thanks
Eddie
You may need to include a REGEX
in the transforms
[set_sourcetype_to_MyAppUDP]
REGEX = .
FORMAT = sourcetype::MyApp-UDP
DEST_KEY = MetaData:Sourcetype
WRITE_META = true
hello everyone, I want to change sourcetype and index in incoming events. In 514UDP I have many different type of logs (cisco, Fortigate, Fortiweb, ....)
How could I change Sourcetype and Index on Heavy Forwarder :(this is my try but it does not work) :
Props:
[source::udp:514]
TRANSFORMS-1sourcetype = fortigateevent
TRANSFORMS-2index_routeing = fortigateeventindex
Transforms:
[fortigateevent]
REGEX = devname= .*
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::fgt_log
[fortigateeventindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = fortinet
You may need to include a REGEX
in the transforms
[set_sourcetype_to_MyAppUDP]
REGEX = .
FORMAT = sourcetype::MyApp-UDP
DEST_KEY = MetaData:Sourcetype
WRITE_META = true