Getting Data In

Help indexs /etc/resolv as sourcetype config_file?

daniel333
Builder

All,

I need to monitor the /etc/resolv as sourcetype config_file in my env. This is well below the 256 byte min for CRC I am sure.

Larger files are working fine, but this is pretty small, 3 lines. It's coming in as hosts_too_small. I clearly have sourcetype set correct in inputs.conf and even tried setting it again with a tranform. But still comes in as "too small".

Any idea how I can get this file correctly indexed as sourcetype config_file?

0 Karma

daniel333
Builder

Just did this, and it worked. Seems like I am solving this wrong.

props.conf:

[(?::){0}*-too_small]
TRANSFORMS-remove_too_small = remove_too_small

transforms.conf:

[remove_too_small]
SOURCE_KEY = MetaData:Sourcetype
DEST_KEY = MetaData:Sourcetype
REGEX = sourcetype::(.*)-too_small
FORMAT = sourcetype::config_file

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...