Getting Data In

Events with reassigned sourcetype (via props and transforms) become unsearchable

splunkIT
Splunk Employee
Splunk Employee

I have the following input:

--inputs.conf--
[monitor:///logs/cisco_raw.txt]
disabled = 0
sourcetype = syslog

The following props and transforms are configured to reassign the sourcetype from syslog to iosVoice, based on the hostname:

--props.conf--
[syslog]
TRANSFORMS-tr7 = set_sourcetype_cisco:ios:voice_by_host

--transforms.conf--
[set_sourcetype_cisco:ios:voice_by_host]
SOURCE_KEY = MetaData:Host
DEST_KEY = MetaData:Sourcetype
FORMAT = iosVoice
REGEX = myhost1.domain.com|myhost2.domain.com

When I search for:

index=main

Splunk is showing the correct sourcetyp: iosVoice

However, if I search:

index=main sourcetype="iosVoice"

Splunk would return 0 event. Why?

1 Solution

splunkIT
Splunk Employee
Splunk Employee

The solution to this problem is that the I did not use

FORMAT = sourcetype::iosVoice

for my format field in transforms.conf. This exact example is actually in the documentation for Splunk here: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

View solution in original post

woodcock
Esteemed Legend

Did you put this file on every one of your indexers and then bounce Splunk on each one afterward?

$SPLUNK_HOME/bin/splunk restart
0 Karma

splunkIT
Splunk Employee
Splunk Employee

The solution to this problem is that the I did not use

FORMAT = sourcetype::iosVoice

for my format field in transforms.conf. This exact example is actually in the documentation for Splunk here: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...