Getting Data In

Splitting sourcetype from a monitor input stanza

tsunamii
Path Finder

I am using a Universal Forwarder to monitor the following directories and files, but somehow it is not routing it to the correct sourcetype. Everything seems to be routing to sourcetype of corepoint_error_log instead.


inputs.conf --
[monitor://E:\Program Files (x86)\Corepoint\CIE\Logs\*\CIEngMonSvc.log]
sourcetype = corepoint_error_log
index = capsule
ignoreOlderThan = 3d
crcSalt = <SOURCE>

[monitor://E:\Program Files (x86)\Corepoint\CIE\Logs\*\CIEngSvc.log]
sourcetype = corepoint_transaction_log
index = capsule
ignoreOlderThan = 3d
crcSalt = <SOURCE>

Tags (1)
0 Karma

splunkIT
Splunk Employee
Splunk Employee

This method will not work because there are conflicts with the stanzas above. You would need to use whitelist in the inputs.conf stanza, along with props.conf and transforms.conf stanzas to route it to the correct sourcetype.


inputs.conf--
[monitor://E:\Program Files (x86)\Corepoint\CIE\Logs]
whitelist = (CIEngMonSvc\.log|CIEngSvc\.log)
sourcetype = corepoint_error_log
index = capsule
ignoreOlderThan = 3d
crcSalt = <SOURCE>

props.conf--
[corepoint_error_log]
TRANSFORMS-transaction_log = transaction_log

transforms.conf--
[transaction_log]
SOURCE_KEY = MetaData:Source
REGEX = CIEngSvc\.log
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::corepoint_transaction_log

jonuwz
Influencer

would you mind explaining the stanza conflict ?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...