Getting Data In

Renaming sourcetype and source with props and transforms

We have some VIOS servers that are special-purpose machines that aren't allowed to have a UF installed. I want to hotwire the Splunk_TA_nix scripts to drop their output on an NFS share for Splunk to pick up. Each VIOS server will drop in a different directory under /exports/ and each script will write to a file with it's name (df.sh > df.log)
I want df.log to go to index=os, sourcetype=df, source=df
ps, iostat, vmstat, etc...
This isn't working:

inputs.conf

[monitor:///exports/vio*/*.log]
disabled = 0
followTail = 0
host =
host_segment = 2
index = os

props.conf

[source:.../df.log]
sourcetype = df
TRANSFORMS-viosdf = viosdf

[source:.../psdf.log]
sourcetype = ps
TRANSFORMS-viosps = viosps

transforms.conf

[viosdf]
DEST_KEY = MetaData:Source
FORMAT = source::df

[viosps]
DEST_KEY = MetaData:Source
FORMAT = source::ps
0 Karma
1 Solution

Ultra Champion

Why not do it all in inputs.conf?

[monitor:///exports/vio*/df.log]
disabled = 0
followTail = 0
host =
host_segment = 2
index = os
sourcetype = df
source = df

[monitor:///exports/vio*/ps.log]
disabled = 0
followTail = 0
host =
host_segment = 2
index = os
sourcetype = ps
source = ps

/Kristian

View solution in original post

Ultra Champion

Why not do it all in inputs.conf?

[monitor:///exports/vio*/df.log]
disabled = 0
followTail = 0
host =
host_segment = 2
index = os
sourcetype = df
source = df

[monitor:///exports/vio*/ps.log]
disabled = 0
followTail = 0
host =
host_segment = 2
index = os
sourcetype = ps
source = ps

/Kristian

View solution in original post

Ouch. That's painfully obvious and I missed it.
Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!