Getting Data In

Props isn't working on overrided sourcetype

ekenne06
Path Finder

I followed this article https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Advancedsourcetypeoverrides

basically I took sourcetype ABC and am doing some regex and searching for 123, if I find that in the event I change the sourcetype to ABC:123. Now for this new sourcetype there is some wonky event breaking. Can I then create a new props entry [ABC:123] and perform all my line breaking and time extracting like I would for any normal event? As of right now it doesn't seem to be working.  I have:

 

 

2021-01-26 00:00:44.2885 [INFO] [NT AUTHORITY\SYSTEM] SIXPACService.SplunkForwarder.SplunkWriter Attempting to Splunk Message from SITA:
<?xml version="1.0" encoding="utf-8"?>
<DCNSMessage>

 

and with the following props for testing:

[ABC:123]

LINE_BREAKER = SIXPACService.(.*)

 

and nothing happened when I tried that props. any ideas?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk doesn't work that way.  It will make a single pass through the props.conf settings for the current sourcetype.  If the sourcetype changes, the props for the new sourcetype will not be processed.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk doesn't work that way.  It will make a single pass through the props.conf settings for the current sourcetype.  If the sourcetype changes, the props for the new sourcetype will not be processed.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

ekenne06
Path Finder

You are correct! I applied my linebreaking to the original sourcetype and it worked like a charm! I appreciate the information.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!