Getting Data In

Sourcetype on SH overwriting config on HF

omuelle1
Communicator

Hi,

I am working in a shared environment with several Heavy Forwarders that sent data to Splunk Cloud Indexers and a shared Splunk Cloud Search Head.

I have noticed that when I set up a sourcetype on the HF with the same name as a sourcetype on the Search head - the Search head sourcetype seems to supersede the configuration of the local sourcetype on the HF.

For example if I specify the timezone TZ=GMT on the sourcetype=IIS on the HF but on the SH the TZ is not set to GMT, it looks to me that sourcetype configuration on the SH supersedes the configuration on the HF. Would that be a correct assumption?

Thank you,

Oliver

0 Karma
1 Solution

solarboyz1
Builder

Correct.

It's possible to have sourcetype over-rides configured on the search head:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Renamesourcetypes
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Advancedsourcetypeoverrides

The search head will rename the sourcetype, then parse the event based on the new sourcetype settings

The sourcetype set by the HF, should still be indexed with the event and depending on how the sourcetype change was done might be available in the field _sourcetype

If the settings on the seach head were removed, the original sourcetype would show up again.

View solution in original post

solarboyz1
Builder

Correct.

It's possible to have sourcetype over-rides configured on the search head:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Renamesourcetypes
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Advancedsourcetypeoverrides

The search head will rename the sourcetype, then parse the event based on the new sourcetype settings

The sourcetype set by the HF, should still be indexed with the event and depending on how the sourcetype change was done might be available in the field _sourcetype

If the settings on the seach head were removed, the original sourcetype would show up again.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...