Getting Data In

Sourcetype overide with a forwarder

Communicator

Hello everyone,

I want to override the sourcetype of my logs with a regex (i know how to do this part)
but i have some issue to know how to override the sourcetype from logs received from a forwarder.

I don't know if i have to modify the props.conf and transforms.conf on the forwarder or on the receiver or if i can do both and specify a thing like [source::tcp:9997]

Can you help me please ?

0 Karma
1 Solution

Ultra Champion

I think you need to provide more details regarding your use case, but the source field of events received from a forwarder will not be [tcp:9997], but rather the path to, and name of, the file that was read by the forwarder. If it is a scripted input, then the name of the script.

This is unlike a Splunk indexer listening to syslog traffic directly, where the source would be [udp:514]

/K

View solution in original post

0 Karma

Ultra Champion

I think you need to provide more details regarding your use case, but the source field of events received from a forwarder will not be [tcp:9997], but rather the path to, and name of, the file that was read by the forwarder. If it is a scripted input, then the name of the script.

This is unlike a Splunk indexer listening to syslog traffic directly, where the source would be [udp:514]

/K

View solution in original post

0 Karma

Ultra Champion

Well, you'll have to look at events that you know are coming from a forwarder, and take the value of the source, and run it through a transform. However, if this value is udp:514, you might catch too many events in your transform, if your indexer is also listening on incoming syslog traffic.

However, if the forwarders are indeed Heavy Forwarders, then you can set up the tranforming there, hopefully being able to only catch the 'correct' events.

0 Karma

Communicator

i have 3 forwarders, they each receive udp:514. They have nothing installed on them and are heavy forwarder.
They forwards using tcp:9997 and my receiver is also listening from UDP:514 and receiving from forwarders.

Each forwarders is sending to a specific index. Now i wants to override sourcetype with a regex.

It's easier for me to make search with this configuration, like index=X sourcetype=Y where X is the index from my forwarder (that's part work fine) and Y is the constructor of the device sending logs.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!