Getting Data In

Can a sourcetype be applied on the server, or does it need to be applied in the forwarder?

Explorer

I am trying to set up a universal forwarder with an inputs.conf which only contains something like this:

[monitor:///path/to/my/logs]

And then have the splunk server apply different sourcetype values to specific logs within that directory with a rule in props.conf like this:

[source::.../name-of-my-log.log...]
sourcetype = my_sourcetype

However, that does not seem to work. Does the sourcetype need to be defined in inputs.conf on the forwarder machine? Is the syntax of my props.conf correct?

Tags (1)

Contributor

you should put it in inputs.conf, like

[monitor:////.../name-of-my-log1.log]
host = your_host_name
sourcetype = your_sourcetype_name
source = your_source_name
index = your_index_name

[monitor:///.../name-of-my-log2.log]
...
...
...

or you can reassign sourcetype by data routing in props.conf and transforms.conf like

in props.conf
[your sourcetype name]
TRANSFORMS-XXXSourcetyping = XXXSourcetyping

in transforms.conf
[XXXSourcetyping]
REGEX = yourREGEX
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::your_sourcetype_name