Getting Data In

Sourcetypes "cross polinating"

brent_weaver
Builder

I am having an issue with Splunk where the sourcetypes are getting mixed up between actualy sources. For example I have a source called caasraw and cf_raw. Events from caasraw get mixed up with cf_raw and vise versa. I am wondering if there is anything in the config that could cause this. I realize that I a REALLY big question but I am wondering if anyone has an initial thoughts.

I should mention that we are going from fluentd to HEC and in fluentd are leveraging the tagging system to pass in splunk metadata, sourcetype, index etc... This my likely be the problem because we are not using the Treasure Data version, instead the open source version.

I am hoping that someone at least has a suggestion on how to initially approach this issue.

Thanks!

Tags (1)
0 Karma

sbbadri
Motivator

I hope below link helps you,

http://docs.splunk.com/Documentation/Splunk/6.6.2/RESTREF/RESTinput# - data/inputs/udp/{name} or data/inputs/udp/

0 Karma

woodcock
Esteemed Legend

Remember btool is your friend.

0 Karma

brent_weaver
Builder

Hey there - I was looking at btool but cannot find the right combo of commands to show me the transforms and props. I have been suspect that the config (somewhere) is causing this. I am concerned that the transforms stanza name is being reused on multiple sourcetypes. What that cause this to happen?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi brent_weaver,
could you share your inputs.conf?
bye.
Giuseppe

0 Karma

brent_weaver
Builder

There is no inputs.conf since this is going through fluentd's syslog input. We use it as a syslog aggregation point.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...