Getting Data In

How to change the target index for logs from certain servers with a Windows universal forwarder, but keep the correct sourcetype?

feisar
Explorer

Hi,

I have one Splunk Enterprise server and a number of Windows servers with the Universal forwarder installed and configured to send logs to the server (indexer).

The logs all arrive and get tagged with the index 'wineventlog' and an appropriate sourcetype, 'WinEventLog:Security' or 'WinEventLog:System' etc. - All good stuff.

However, I'd like to change the index for certain servers (as I have done for various switches etc.). I have tried this using props.conf and transforms.conf with rules like this:

props.conf

[host::WINSERVER01]
TRANSFORMS-winevent_dmz = set_index_winevent_dmz

transforms.conf

[set_index_winevent_dmz]
DEST_KEY = _MetaData:Index
FORMAT = winevent_dmz
REGEX = .

But when I do this, although the index does change, the appropriate sourcetype stops being applied and the logs all get assigned a 'splunkd' sourcetype.

Can anyone explain why this happens and let me know the correct way to change the index of logs coming from the Forwarder, but keep the correct sourcetype?

Thanks

0 Karma

sanjeev543
Communicator

I agree with @maciep , if you still want to move to other index at the index time, please check if you can do it by using sourcetype
For example:

props.conf

[WinEventLog:Security]
TRANSFORMS-winevent_dmz = set_index_winevent_dmz

transforms.conf

[set_index_winevent_dmz]
SOURCE_KEY = MetaData:Host
REGEX = (WINSERVER01|WINSERVER02|WINSERVER03....)
DEST_KEY = _Metadata:Index
FORMAT = winevent_dmz
0 Karma

maciep
Champion

Look like you are applying that change to all data coming from that host. That includes splunk's internal log files. Are you sure that you're not just accidentally sending the _internal data to the winevent_dmz index now? Maybe along with the eventlog data? That would explain the splunkd sourcetype.

Also, it might be easier to just do this from the frowarder on winserver01 in the inputs.conf. Just update the index there. If you have windows app installed, just be sure to make your changes in the local directory instead of default.

0 Karma

woodcock
Esteemed Legend

I don't know why it is happening but you can add a sourcetype= directive to your props.conf stanza to force it back.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...