Getting Data In

Sourcetype overide with a forwarder

ddarmand
Communicator

Hello everyone,

I want to override the sourcetype of my logs with a regex (i know how to do this part)
but i have some issue to know how to override the sourcetype from logs received from a forwarder.

I don't know if i have to modify the props.conf and transforms.conf on the forwarder or on the receiver or if i can do both and specify a thing like [source::tcp:9997]

Can you help me please ?

0 Karma
1 Solution

kristian_kolb
Ultra Champion

I think you need to provide more details regarding your use case, but the source field of events received from a forwarder will not be [tcp:9997], but rather the path to, and name of, the file that was read by the forwarder. If it is a scripted input, then the name of the script.

This is unlike a Splunk indexer listening to syslog traffic directly, where the source would be [udp:514]

/K

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

I think you need to provide more details regarding your use case, but the source field of events received from a forwarder will not be [tcp:9997], but rather the path to, and name of, the file that was read by the forwarder. If it is a scripted input, then the name of the script.

This is unlike a Splunk indexer listening to syslog traffic directly, where the source would be [udp:514]

/K

0 Karma

kristian_kolb
Ultra Champion

Well, you'll have to look at events that you know are coming from a forwarder, and take the value of the source, and run it through a transform. However, if this value is udp:514, you might catch too many events in your transform, if your indexer is also listening on incoming syslog traffic.

However, if the forwarders are indeed Heavy Forwarders, then you can set up the tranforming there, hopefully being able to only catch the 'correct' events.

0 Karma

ddarmand
Communicator

i have 3 forwarders, they each receive udp:514. They have nothing installed on them and are heavy forwarder.
They forwards using tcp:9997 and my receiver is also listening from UDP:514 and receiving from forwarders.

Each forwarders is sending to a specific index. Now i wants to override sourcetype with a regex.

It's easier for me to make search with this configuration, like index=X sourcetype=Y where X is the index from my forwarder (that's part work fine) and Y is the constructor of the device sending logs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...