MetaData:Index and MetaData:Sourcetype overridding sourcetype

[Abhay]

Hi Splunkers,

My greetings !! !!

I have data coming from the Syslog server for which sourcetype Is "syslog", now, I have split the data going to three diff indexers in transfroms.conf using MetaData:Index and using the regular expression like (abc* | xyz* ), and it is working fine.

Now, I need to hardcode the sourcetype for each of the data going to the different index, now the sourcetype is coming as "syslog" but I want for every separate index I need to have separate sourcetype name .

Can you plz help !! 

[PickleRick]

Why don't you use an external syslog collector? SC4S or rsyslog? The configuration is more straightforward and you can have configuration working on network-level metadata. And is more efficient.

[richgalloway]

It seems like you're doing that the hard way.  I usually set up the syslog server to filter events based on source/content/whatever and put them into separate destination files.  Then the UF monitors those files and has inputs.conf settings for each one that specifies the target index and sourcetype.

[Abhay]

I could havd done the same thing, but the problem is somebody has already configured to have all the data to come  in one file itself.

Now, I need to use transforms.conf to set the new sourcetype instead of "syslog" sourcetype 

[richgalloway]

You inherited someone else's mistake, but that doesn't mean you have to live with it.  IMO, you'll be doing yourself and your successor a favor by re-configuring the syslog server.

If that's not possible then please describe how you've tried changing the sourcetype.