Getting Data In

Same data input two apps?

token2
Path Finder

Is it possible to share a sourcetype'd data between two apps?

I have pfsense sending both firewall logs and Suricata eve json logs to the same UDP data input.  The TA-pfsense app is sourcetyping, field extracting and indexing the various syslog types from pfsense.  The TA-Suricata has the props.conf, lookups, eventtypes etc to extract relevant data from the eve json logs mixed into this UDP data stream. 

Is there a way to send the sourcetype:suricata from the TA-pfsense props to point to the TA-Suricata inputs.conf?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One should not send two different sourcetypes to the same input port because, as you've learned, it can be very difficult to distinguish them later.  I recommend you do everything in your power to have the two sources arrive at two different ports.

If that is not possible then all is not necessarily lost.  I hope you are using, as is considered Best Practice, a syslog server to receive the UDP inputs.  You may be able to configure the syslog server to write the different sourcetypes to different files based upon the source addresses.  Then Splunk's universal forwarder can read each file and know each source type from the file location.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

One should not send two different sourcetypes to the same input port because, as you've learned, it can be very difficult to distinguish them later.  I recommend you do everything in your power to have the two sources arrive at two different ports.

If that is not possible then all is not necessarily lost.  I hope you are using, as is considered Best Practice, a syslog server to receive the UDP inputs.  You may be able to configure the syslog server to write the different sourcetypes to different files based upon the source addresses.  Then Splunk's universal forwarder can read each file and know each source type from the file location.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!