Changing Sourcetype at Index Time on Heavy Forwarder?

[marrette]

Hi,

I would like to change the sourcetype of data being received from a UDP Syslog stream via a heavy forwarder.

On the heavy forwarder I have deployed an app configured with the following:

inputs.conf:

[udp://10.1.2.3:514]
connection_host = dns
index = MyIndex
sourcetype = syslog

Data sent to the Splunk Heavy Forwarder host (Splunk version 6.4.1 running on Windows) is received by Splunk and the sourcetype, as expected is set to syslog. I would like to change the sourcetype to something more descriptive and have found if I just edit the sourcetype in the inputs.conf file data is not received (I assume setting the sourcetype to syslog effects the way Splunk behaves as it receives the data?)

So anyway I created a props.conf file with the following in:
props.conf:

[syslog]
TRANSFORMS-changesourcetype = set_sourcetype_to_MyAppUDP

and then created a transforms.conf like this:

[set_sourcetype_to_MyAppUDP]
FORMAT = sourcetype::MyApp-UDP
DEST_KEY = MetaData:Sourcetype
WRITE_META = true

I've deployed it to the heavy forwarder and am receiving data but the sourcetype is not being changed and I'm unsure why?

Thanks
Eddie

[tahaeeh]

hello everyone, I want to change sourcetype and index in incoming events. In 514UDP I have many different type of logs (cisco, Fortigate, Fortiweb, ....)

How could I change Sourcetype and Index on Heavy Forwarder :(this is my try but it does not work) :

Props:

[source::udp:514]
TRANSFORMS-1sourcetype = fortigateevent
TRANSFORMS-2index_routeing = fortigateeventindex

Transforms:

[fortigateevent]
REGEX = devname= .*
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::fgt_log

[fortigateeventindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = fortinet

[sduff_splunk · Accepted solution]

You may need to include a REGEX in the transforms

 [set_sourcetype_to_MyAppUDP]
 REGEX = .
 FORMAT = sourcetype::MyApp-UDP
 DEST_KEY = MetaData:Sourcetype
 WRITE_META = true