Shouldn't this work ? Only If I assign the sourcetype in the inputs.conf of the Universal forwarder this works.. But I don't want to assign it in UF.
I'm on linux btw.
* sourcetype assignment settings on a system receiving forwarded splunk data will not be applied to forwarded data.
You heavy forwarder is receiving forwarded data from UF and forwarding it to Indexers, so it doesn't work there. Any specific reason for not doing sourcetype assignment from inputs.conf?
If you still want to do sourcetype assignment from HF, try this
[source::..../config/server.cnf] TRANSFORMS-stoverride = set_my_weird_sourcetype
[set_my_weird_sourcetype] DEST_KEY = MetaData:Sourcetype REGEX = . FORMAT = sourcetypet::$1
Yeh, I also read this in the docs:
Note: If you forward data, and you want to assign a source type for a source, you must assign the source type in props.conf on the forwarder. If you do it in props.conf on the receiver, the override has no effect.
So I started using in the props.conf in the UF and it worked. I'll try your version on the HF now. Thanks!
Btw man, what can I do if I want to override a sourcetype that I have already assigned ? Example:
For a ".cnf" file I assign a generic sourceType. But sometimes in those files, it comes XML written and I wanted to assign a new sourcetype with "KV_MODE = xml". Any ideas, like a Regex searching inside the file and alert me for a XML match and then assign that very XmlSourceType ? Thanks