How to use transforms.conf to assign a custom index and sourcetype?

[adamblock2]

I am currently trying, unsuccessfully, to assign a custom sourcetype and index from within a local/transforms.conf file.

The following is a sample log entry:

Oct 20 18:00:01 cc-mailserver event="Mail Details" src_ip="x.y.251.54" src_port="57709" dst_ip="x.y.17.128" dst_port="25" message_date="Tue, 20 Oct 2015 18:11:06 -0400 (EDT)" from="Bamboo <[email protected]>" to="[email protected]" reply="" envel_from="<[email protected]>" 

The following are the entries in my transforms.conf file:

Index Routing

[force_index_for_mail_scrape]
REGEX = cc-mailserver
FORMAT = security
DEST_KEY = _MetaData:Index

Sourcetype Routing

[force_sourcetype_for_mail_scrape]
REGEX = cc-mailserver
FORMAT = sourcetype::mail_scrape
DEST_KEY = MetaData:Sourcetype

The data is currently appearing with index=main and sourcetype=mail_scrape-3. The above config is being pushed both to the search heads as well as the indexers.

Any assistance would be appreciated.

[woodcock]

Update pros.conf like this:

[yourSourceType]
TRANSFORMS-this_text_does_not_really_matter = force_index_for_mail_scrape, force_sourcetype_for_mail_scrape

[adamblock2 · Accepted solution]

I re-checked the props.conf file, and I noticed that the values "force_index_for_mail_scrape" and "force_sourcetype_for_mail_scrape" had not been added. Once the values were added, the custom index and sourcetype values were applied properly.

[MuS]

what does the props.conf look like and did you restart spunk after the change? Also note this will only be valid for new events.