Getting Data In

Can the Universal Forwarder overwite the source with transforms.conf?

mkelderm
Path Finder

(updated with correct solution)

Question: I want to overwite the source when the UF is sending data to the Splunk server. This is how it should be.

On the UF the config is splunkforwarder/etc/system/local:

inputs.conf

[monitor:///data/logs/UCMFON/*.access]
disabled = false
followTail = 1
host = $decideOnStartup
index = fon
sourcetype = access:web:ucm

On the Splunk Server (indexer) the config is splunk/system/local:

props.conf

[access:web:ucm]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=50
TRANSFORMS-source=extract-filename-from-source

transforms.conf

[extract-filename-from-source]
# /a/b/c/e1_fgh2.log
# removes directory
#
DEST_KEY=MetaData:Source
SOURCE_KEY=MetaData:Source
REGEX  = (([\w|\d|-]*)\.\w*)
FORMAT = source::$1
0 Karma
1 Solution

jonuwz
Influencer

See here

If you want to use anything in transforms.conf, it has to be done on an indexer

So its valid to set the sourcetype on the UF, but the logic for setting the source will need to be moved up to your indexer(s)

View solution in original post

qjvtenkroode
Explorer

One thing you're missing. Your regex is exactly "source:: ...." Drop the first part, source:: and it will work.

0 Karma

mkelderm
Path Finder

Thanks! Fixed the issue!

0 Karma

jonuwz
Influencer

See here

If you want to use anything in transforms.conf, it has to be done on an indexer

So its valid to set the sourcetype on the UF, but the logic for setting the source will need to be moved up to your indexer(s)

Ayn
Legend

Yes, both the props.conf and transforms.conf settings need to go on the indexer.

0 Karma

mkelderm
Path Finder

So I need to move my transforms.conf to the splunk-server (the indexer)? In the same directory?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...