Getting Data In

How to change syslog host to a specific sourcetype?

Path Finder

I'm getting syslog from a specific host in Splunk. How do I create a sourcetype for that host?

0 Karma

Influencer

I don't recommend trying to change sourcetype after the event has been received. The best way would be to create a separate stanza for the host in question, either by giving it a different port, or specifying the host in a copy of the existing:

[udp://514]
sourcetype = genpop

[udp://specialhost:514]
sourcetype = special

OR

[udp://514]
sourcetype = genpop

[udp://5114]
sourcetype = special_type

SplunkTrust
SplunkTrust

I second the above approach, but if this is not possible for you to do; here is an example how to re-write the sourcetype based on the hostname https://answers.splunk.com/answers/369375/how-do-i-set-different-source-types-on-one-data-in-1.html this example uses a TCP input but applies to syslog over UDP as well 😉

cheers, MuS

0 Karma

Path Finder

Twinspop,

Which file do i create the stanza in?

0 Karma

Influencer

You can either edit inputs.conf directly or update via the GUI. Through the GUI, use the More settings area in the UDP definition page to see "restrict to host" to set the 1st type I listed above. For the second type, simple create a new UDP input with a new, unique port. To modify through the CLI using the inputs.conf file, you'd want to find the one your input is already defined in. Possibly in the search or launcher app directory structures, under local.

0 Karma