I have the following input:
--inputs.conf--
[monitor:///logs/cisco_raw.txt]
disabled = 0
sourcetype = syslog
The following props and transforms are configured to reassign the sourcetype from syslog to iosVoice, based on the hostname:
--props.conf--
[syslog]
TRANSFORMS-tr7 = set_sourcetype_cisco:ios:voice_by_host
--transforms.conf--
[set_sourcetype_cisco:ios:voice_by_host]
SOURCE_KEY = MetaData:Host
DEST_KEY = MetaData:Sourcetype
FORMAT = iosVoice
REGEX = myhost1.domain.com|myhost2.domain.com
When I search for:
index=main
Splunk is showing the correct sourcetyp: iosVoice
However, if I search:
index=main sourcetype="iosVoice"
Splunk would return 0 event. Why?
The solution to this problem is that the I did not use
FORMAT = sourcetype::iosVoice
for my format field in transforms.conf. This exact example is actually in the documentation for Splunk here: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides
Did you put this file on every one of your indexers and then bounce Splunk on each one afterward?
$SPLUNK_HOME/bin/splunk restart
The solution to this problem is that the I did not use
FORMAT = sourcetype::iosVoice
for my format field in transforms.conf. This exact example is actually in the documentation for Splunk here: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides