Assigning sourcetype to a source in HeavyForwarder props.conf is not working

[greggz]

Shouldn't this work ? Only If I assign the sourcetype in the inputs.conf of the Universal forwarder this works.. But I don't want to assign it in UF.

[source::///...../config/server.cnf]
sourcetype=my_weird_sourcetype

I'm on linux btw.

[somesoni2]

As per http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf#Sourcetype_configuration ,

* sourcetype assignment settings on a system receiving forwarded splunk data
  will not be applied to forwarded data.

You heavy forwarder is receiving forwarded data from UF and forwarding it to Indexers, so it doesn't work there. Any specific reason for not doing sourcetype assignment from inputs.conf?

If you still want to do sourcetype assignment from HF, try this

HF props.conf

[source::..../config/server.cnf]
TRANSFORMS-stoverride =  set_my_weird_sourcetype

HF transforms.conf

[set_my_weird_sourcetype]
DEST_KEY = MetaData:Sourcetype
REGEX = .
FORMAT = sourcetypet::$1

[greggz]

Btw man, what can I do if I want to override a sourcetype that I have already assigned ? Example:

For a ".cnf" file I assign a generic sourceType. But sometimes in those files, it comes XML written and I wanted to assign a new sourcetype with "KV_MODE = xml". Any ideas, like a Regex searching inside the file and alert me for a XML match and then assign that very XmlSourceType ? Thanks

[greggz]

Yeh, I also read this in the docs:

Note: If you forward data, and you want to assign a source type for a source, you must assign the source type in props.conf on the forwarder. If you do it in props.conf on the receiver, the override has no effect.

So I started using in the props.conf in the UF and it worked. I'll try your version on the HF now. Thanks!