Setting sourcetype based on source via .conf file

[deepak02]

Hi,

I had an Application Server feeding logs into Splunk. Details as follows,

Source: /abc/logs/System-Perf-managed-vm1.log
Sourcetype: SystemPerf

The Application Server recently changed to a different name, and the sourcetype changed too.

Source: /abc/logs/System-PerfRest-managed-vm5.log
Sourcetype: SystemPerfRest

There seems to be a mapping between the source and the sourcetypes.
I do not have access to the conf files. I would like to know where this mapping will be defined (inputs.conf/props.conf/transforms.conf).

Thanks,
Deepak

[woodcock]

As Splunk admin, whenever I have to modify a sourcetype, I always also add a sourcetype rename to props.conf so that the old/wrong sourcetype appears (at search time) as the new/correct sourcetype:

https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Renamesourcetypes

[cpetterborg]

Typically:

inputs.conf lists the files to be indexed (source) and which sourcetype for that source. This would go on the deployment server to be distributed to the universal forwarders.

props.conf usually goes on the indexers (though the cluster master if you are in a clustered environment) and maps the sourcetype (typically) to how the indexers are supposed to parse the file for indexing. It also identifies transforms that can be found in the transforms.conf file.

transforms.conf usually goes along with the props.conf file to define the transforms to the data, which may include the file name (source), the data transforms (actual changes to the data), and other such actions.

So the mapping occurs from the source to the sourcetype typically through the inputs.conf file, though that can be modified through the props.conf and transforms.conf files.

[lguinn2]

This could be defined in the inputs.conf or (more likely) it could be defined in the props.conf

[source::/abc/logs/System-PerfRest-managed-vm5.log]
sourcetype=abc

However, there might not be any setting for sourcetype in either of these files. By default, when no sourcetype is explicitly supplied and Splunk cannot identify the sourcetype, it automatically assigns a portion of the file name as the sourcetype.
You can override this behavior by putting the above stanza in a props.conf file that is located in the same directory as the inputs.conf file.