Hunk - assigning sourcetype

[jwalzerpitt]

I create two virtual indexes within Hunk that reads from two separate HDFS directory. One is for Cisco ASA logs, and the other is for IIS logs. Each HDFS directory contains a bunch of *.log files. Clicking on 'search' for either index starts to index/read all of the log files, but the sourcetype is set wrong for both indexes.

How do I assign the correct sourcetype to each index?

Thx

[jwalzerpitt]

That worked. Just had to change the search to:

index="web_logs" source="/logs/web/ex140401.log"

Once I did that, I got an "Interesting Fields" list, with the parsed out fields.

So that applies to searching individual log files (basically using 'Exploring Data'). How do I apply the new manual-iis to all IIS log files when I go in to search the entire virtual index? When I click 'search' there, the files aren't being parsed per the IIS sourcetype.

Thx

[Ledion_Bitincka]

Great! Now, simply replace the single source stanza with the following in order to apply the "new-iis" sourcetype to all the files under /logs/web/

   /opt/hunk/etc/apps/search/local/props.conf
   [source::/logs/web/...]
   sourcetype = new-iis
   priority = 10 

[jwalzerpitt]

Awesome!! That worked...

Now the last issue I'm wrestling with is that the ASA logs are not being properly identified even when I select cisco : asa as the sourcetype. Here's a sample ASA log:

Apr 10 06:29:58 1.1.1.1 %ASA-7-106100: access-list np-itf15-FW-RULE-1 permitted udp FW-RULE-2/2.2.2.2(615) -> FW-RULE-3/3.3.3.3(111) hit-cnt 1 first hit [0x7eb55e24, 0xc85ef7a5]

Switching between cisco : asa and System Defaults doesn't make a difference.

Do I need to build a custom Cisco ASA in props and transform.conf for Cisco ASA like IIS?

[jwalzerpitt]

Thx - let me add and test again

[jwalzerpitt]

After some additional review, for the IIS logs I see they're being tagged as a sourcetype of IIS, but they're not being parsed correctly. Any ideas on how to troubleshoot that issue?

The Cisco ASA logs aren't being identified as the correct sourcetype at all.