(updated with correct solution)
Question: I want to overwite the source when the UF is sending data to the Splunk server. This is how it should be.
On the UF the config is splunkforwarder/etc/system/local:
[monitor:///data/logs/UCMFON/*.access] disabled = false followTail = 1 host = $decideOnStartup index = fon sourcetype = access:web:ucm
On the Splunk Server (indexer) the config is splunk/system/local:
[access:web:ucm] NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIME_PREFIX=^ MAX_TIMESTAMP_LOOKAHEAD=50 TRANSFORMS-source=extract-filename-from-source
[extract-filename-from-source] # /a/b/c/e1_fgh2.log # removes directory # DEST_KEY=MetaData:Source SOURCE_KEY=MetaData:Source REGEX = (([\w|\d|-]*)\.\w*) FORMAT = source::$1
If you want to use anything in transforms.conf, it has to be done on an indexer
So its valid to set the sourcetype on the UF, but the logic for setting the source will need to be moved up to your indexer(s)
So I need to move my transforms.conf to the splunk-server (the indexer)? In the same directory?
One thing you're missing. Your regex is exactly "source:: ...." Drop the first part, source:: and it will work.