Getting Data In

How to map a sourcetype based on the values in the event?

a212830
Champion

Hi,

I have some nicely defined logfiles, with all key-value pair entries. We'd like to create dynamic sourcetypes, based upon one of the values in the event. Is this possible?

0 Karma

somesoni2
Revered Legend
0 Karma

javiergn
SplunkTrust
SplunkTrust

Yes, see this:

http://docs.splunk.com/Documentation/Splunk/6.3.3/Data/Advancedsourcetypeoverrides

Example 1 (static sourcetype name):

[set_sourcetype_my_log_for_some_hosts]
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(host1|host2|host3)[\w\.\-]*\]?\s
FORMAT = sourcetype::my_log
DEST_KEY = MetaData:Sourcetype

Example 2 (dynamic host name but you can apply the same logic to MetaData:Sourcetype):

[syslog-host]
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(\w[\w\.\-]{2,})\]?\s
FORMAT = host::$1
DEST_KEY = MetaData:Host
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!