Getting Data In

Same data input two apps?

token2
Path Finder

Is it possible to share a sourcetype'd data between two apps?

I have pfsense sending both firewall logs and Suricata eve json logs to the same UDP data input.  The TA-pfsense app is sourcetyping, field extracting and indexing the various syslog types from pfsense.  The TA-Suricata has the props.conf, lookups, eventtypes etc to extract relevant data from the eve json logs mixed into this UDP data stream. 

Is there a way to send the sourcetype:suricata from the TA-pfsense props to point to the TA-Suricata inputs.conf?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One should not send two different sourcetypes to the same input port because, as you've learned, it can be very difficult to distinguish them later.  I recommend you do everything in your power to have the two sources arrive at two different ports.

If that is not possible then all is not necessarily lost.  I hope you are using, as is considered Best Practice, a syslog server to receive the UDP inputs.  You may be able to configure the syslog server to write the different sourcetypes to different files based upon the source addresses.  Then Splunk's universal forwarder can read each file and know each source type from the file location.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

One should not send two different sourcetypes to the same input port because, as you've learned, it can be very difficult to distinguish them later.  I recommend you do everything in your power to have the two sources arrive at two different ports.

If that is not possible then all is not necessarily lost.  I hope you are using, as is considered Best Practice, a syslog server to receive the UDP inputs.  You may be able to configure the syslog server to write the different sourcetypes to different files based upon the source addresses.  Then Splunk's universal forwarder can read each file and know each source type from the file location.

---
If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Running multiple macros in the same search

Hi all!I'm trying to run multiple macros in the same search and eventually aggregate the results from each ...

Logic of Compound Subsearch with inputlookup

I'm struggling to create a search using an inputlookup and multiple NOT searches.Background: I have an ...

Tagging Heavy Forwarders

This is a tip, not a question.&nbsp;<span class="lia-unicode-emoji" ...