Sourcetype overide with a forwarder

[ddarmand]

Hello everyone,

I want to override the sourcetype of my logs with a regex (i know how to do this part)
but i have some issue to know how to override the sourcetype from logs received from a forwarder.

I don't know if i have to modify the props.conf and transforms.conf on the forwarder or on the receiver or if i can do both and specify a thing like [source::tcp:9997]

Can you help me please ?

[kristian_kolb · Accepted solution]

I think you need to provide more details regarding your use case, but the source field of events received from a forwarder will not be [tcp:9997], but rather the path to, and name of, the file that was read by the forwarder. If it is a scripted input, then the name of the script.

This is unlike a Splunk indexer listening to syslog traffic directly, where the source would be [udp:514]

/K

[kristian_kolb]

Well, you'll have to look at events that you know are coming from a forwarder, and take the value of the source, and run it through a transform. However, if this value is udp:514, you might catch too many events in your transform, if your indexer is also listening on incoming syslog traffic.

However, if the forwarders are indeed Heavy Forwarders, then you can set up the tranforming there, hopefully being able to only catch the 'correct' events.

[ddarmand]

i have 3 forwarders, they each receive udp:514. They have nothing installed on them and are heavy forwarder.
They forwards using tcp:9997 and my receiver is also listening from UDP:514 and receiving from forwarders.

Each forwarders is sending to a specific index. Now i wants to override sourcetype with a regex.

It's easier for me to make search with this configuration, like index=X sourcetype=Y where X is the index from my forwarder (that's part work fine) and Y is the constructor of the device sending logs.