Getting Data In

Applying different extractions to the same source from different hosts

krisreeves
Path Finder

I have two groups of servers that are both running haproxy, and the logs are in the same location (e.g. /var/log/haproxy.log). The log format is different for each of them. I'd like to specify to apply one REPORT transform to haproxy logs coming from *.foo.com and a different REPORT transform to haproxy logs coming from *.bar.com (search-time field extractions). I can't change the sourcetype name itself, it's expected to be 'haproxy' in both cases.

I can't determine any easy way to have a props.conf stanza that matches both a source AND a host, but it seems wasteful and slow to run two giant regular expressions for every line when only one needs to be applied.

Are there any config tricks that can be used here?

0 Karma

FrankVl
Ultra Champion

One trick can be to create a symlink that contains the server’s name (or some other string that helps you keep the two formats apart) which points tot the original log folder. Then point Splunk to the symlink (can still be a generic input stanza by using wildcard), such that the source value now becomes host specific.

We use this often to identify what syslog server a certain event passed through while keeping the original sending device in the host field.

0 Karma

ddrillic
Ultra Champion

It's interesting as you can use wildcards and regex for source and host stanzas in props.conf... but you need a combo ; - )

@MuS spoke to that at Can I have multiple specs (host, source, sourcetype) in props.conf?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...