Sourcetype Rename Help

[dwilson333]

All,
Very new to splunk here. I have data coming in from an app which we'll call "siebel". It's inputs looks like this.

[code]
[monitor://C:\Siebel\sba81\siebsrvr\enterprises\PROD\PROD_SCG*\log]
ignoreOlderThan=14d
index=siebel
recursive = true
[/code]

I'd like to manually specify the sourcetype. I created in the same app a "props.conf" which reads as such
[code]
[source::\C:\Siebel\sba81\siebsrvr\enterprises\PROD\PROD_SCG*\log\]
sourcetype=siebel_scg_logs
[/code]

I saved and restarted my deployment server. So far I have no seen the new Sourcetype and data come in. What might I be doing wrong?

[srioux]

Any reason you wouldn't set the sourcetype explicitly through the inputs.conf?

If you really want to use props, it would have to be pushed out to the indexer (not forwarder), as that's where the parsing's done.

[srioux]

The recommendation still remains that you set it in inputs.conf explicitly. That being said, if your intent is still to use props make sure that the 'source' entry actually matches what Splunk thinks the source is (look at your data in the UI to see). If there are typos, or anything weird it may not match.

You can always use Splunk btool to have a look. Just run the following on your indexer:

$SPLUNK_HOME/bin/splunk cmd btool props list

Take a look at what configs show up for that particular source.

[Ayn]

Again, why not just set the sourcetype in inputs.conf right from the start? There are reasons why your props.conf entries won't work and there are ways to make it work, but it's really much more complicated and unnecessary than setting the sourcetype to the correct value in inputs.conf directly.

[dwilson333]

Thanks for replying. Yes. The code above is being pushed to the indexers. But still nothing coming through. Just noticed I had uneeded "\" in there. SO I just removed it. Still no luck. Any idea why this might not work?

[code]
[source::C:\Siebel\sba81\siebsrvr\enterprises\PROD\PROD_SCG*\log]
sourcetype=siebel_scg_logs
[/code]