Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to override the props source?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the below configured but source is not being over written. I am trying to wild card anything after Windows in the path.
props.conf
[source::/var/log/Windows/*]
TRANSFORMS-changesource=changesource
transforms.conf
[changesource]
FORMAT= source::WinEventLog:Security
DEST_KEY=MetaData:Source
I have it deployed to my heavy forwarder. It's not working there. I am also curious if I can deploy something like this to a Universal Forwarder after I am sure the syntax is correct?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you have further sub-directories behind /var/log/Windows/, you need to use the ... wildcard instead of *. So try [source::/var/log/Windows/...] instead.
And no, these operations cannot be done on UF. Unless this specific source value matches a specific inputs.conf stanza, then you could set the source field as part of the inputs.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you have further sub-directories behind /var/log/Windows/, you need to use the ... wildcard instead of *. So try [source::/var/log/Windows/...] instead.
And no, these operations cannot be done on UF. Unless this specific source value matches a specific inputs.conf stanza, then you could set the source field as part of the inputs.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would prefer to set source as part of the inputs.conf Can I override the source in inputs.conf?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the current sources are /var/log/LOGCENTRAL/Windows/hostname/hostname.log. This obviously varies as there are many hosts writing logs. My props is now [source::/var/log/LOGCENTRAL/Windows/...] and thats not working either.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think you need to add a REGEX = . to your transforms.conf. That setting is required for index-time extractions like this. Sorry for not catching that earlier.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you can simply add source = WinEventLog:Security to the relevant inputs.conf stanza.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
a simple read of the inputs.conf spec gave me the answer 🙂 Thanks!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
