Getting Data In

How to use transforms.conf to assign a custom index and sourcetype?

Path Finder

I am currently trying, unsuccessfully, to assign a custom sourcetype and index from within a local/transforms.conf file.

The following is a sample log entry:

Oct 20 18:00:01 cc-mailserver event="Mail Details" src_ip="x.y.251.54" src_port="57709" dst_ip="x.y.17.128" dst_port="25" message_date="Tue, 20 Oct 2015 18:11:06 -0400 (EDT)" from="Bamboo <Bamboo@myserver.net>" to="Bamboo2@myserver.net" reply="" envel_from="<Bamboo@myserver.net>" 

The following are the entries in my transforms.conf file:

Index Routing

[force_index_for_mail_scrape]
REGEX = cc-mailserver
FORMAT = security
DEST_KEY = _MetaData:Index

Sourcetype Routing

[force_sourcetype_for_mail_scrape]
REGEX = cc-mailserver
FORMAT = sourcetype::mail_scrape
DEST_KEY = MetaData:Sourcetype

The data is currently appearing with index=main and sourcetype=mail_scrape-3. The above config is being pushed both to the search heads as well as the indexers.

Any assistance would be appreciated.

0 Karma
1 Solution

Path Finder

I re-checked the props.conf file, and I noticed that the values "force_index_for_mail_scrape" and "force_sourcetype_for_mail_scrape" had not been added. Once the values were added, the custom index and sourcetype values were applied properly.

View solution in original post

0 Karma

Esteemed Legend

Update pros.conf like this:

[yourSourceType]
TRANSFORMS-this_text_does_not_really_matter = force_index_for_mail_scrape, force_sourcetype_for_mail_scrape

Path Finder

I re-checked the props.conf file, and I noticed that the values "force_index_for_mail_scrape" and "force_sourcetype_for_mail_scrape" had not been added. Once the values were added, the custom index and sourcetype values were applied properly.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

what does the props.conf look like and did you restart spunk after the change? Also note this will only be valid for new events.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!