Getting Data In

Logs not picking sourcetype from props.conf in apps/local folder on heavy forwarder

arunkumarkyamaj
Engager

Hi,
we want to parse the logs on HF before logs are forwarded to indexers. logs are forwarded from universal forwarder to heavy forwarder. I have given sourcetype in inputs.conf on UF and created props.conf with same sourcetype value stanza( extract = regex). logs are comeing with sourcetype i have given in inputs.conf but its not picking file in props.conf where the regex is. so logs are not parsed. i have tested props.conf and it parsed correctly on test environment but this by uploading file. Am i missing anything here ?

0 Karma
1 Solution

arjunpkishore5
Motivator

There's your problem, EXTRACT is used to define search time filed extractions and not index time extractions, these work only on your search head.

On your heavy forwarder, you need to use TRANSFORM- along with an accompanying transforms.conf - https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Transformsconf

View solution in original post

0 Karma

arjunpkishore5
Motivator

There's your problem, EXTRACT is used to define search time filed extractions and not index time extractions, these work only on your search head.

On your heavy forwarder, you need to use TRANSFORM- along with an accompanying transforms.conf - https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Transformsconf

0 Karma

arunkumarkyamaj
Engager

Thank you! that worked.

0 Karma

arjunpkishore5
Motivator

Have you also placed the props.conf on the UF? If yes, remove the props.conf on the UF. Could you also paste the contents of the props.conf here?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you load the props.conf file on the HF and restart the HF?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

arunkumarkyamaj
Engager

yes. i did.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>