Getting Data In

Setting sourcetype and source fields dynamically via inputs.conf

nterry
Path Finder

I was reading the docs for inputs.conf and noticed that there are host _regex and host _segment attributes to the monitor stanzas. I want to be able to set the source and sourcetype attributes with a regex (just like host _regex and host _segment) as well. I know you can set it in transforms.conf, but I need to be able to set it on a per-file basis, not a per-event basis.

Does anyone have any ideas as to how to accomplish this?

0 Karma

kristian_kolb
Ultra Champion

Well, perhaps this may not be applicable for you, but you can set the sourcetype somewhat dynamically with props.conf rules. This will examine the content of a file and set the sourcetype if the rules match.

[rule::bar_some]
sourcetype = source_with_lots_of_bars
# if more than 80% of lines have "----", but fewer than 70% have "####" declare this a
# "source_with_lots_of_bars"
MORE_THAN_80 = ----
LESS_THAN_70 = ####

A rule can have many MORE_THAN and LESS_THAN patterns, and all are required for the rule
to match.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Hope this helps,

Kristian

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can only set source and sourcetype to a fixed string in inputs.conf. You cannot set it to be a regex or segment of the pathname. To set to a fixed string, use source = ... or sourcetype = ....

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...