Getting Data In
Highlighted

Setting sourcetype and source fields dynamically via inputs.conf

Path Finder

I was reading the docs for inputs.conf and noticed that there are host _regex and host _segment attributes to the monitor stanzas. I want to be able to set the source and sourcetype attributes with a regex (just like host _regex and host _segment) as well. I know you can set it in transforms.conf, but I need to be able to set it on a per-file basis, not a per-event basis.

Does anyone have any ideas as to how to accomplish this?

0 Karma
Highlighted

Re: Setting sourcetype and source fields dynamically via inputs.conf

Splunk Employee
Splunk Employee

You can only set source and sourcetype to a fixed string in inputs.conf. You cannot set it to be a regex or segment of the pathname. To set to a fixed string, use source = ... or sourcetype = ....

Highlighted

Re: Setting sourcetype and source fields dynamically via inputs.conf

Ultra Champion

Well, perhaps this may not be applicable for you, but you can set the sourcetype somewhat dynamically with props.conf rules. This will examine the content of a file and set the sourcetype if the rules match.

[rule::bar_some]
sourcetype = source_with_lots_of_bars
# if more than 80% of lines have "----", but fewer than 70% have "####" declare this a
# "source_with_lots_of_bars"
MORE_THAN_80 = ----
LESS_THAN_70 = ####

A rule can have many MORE_THAN and LESS_THAN patterns, and all are required for the rule
to match.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Hope this helps,

Kristian