Splunk sourcetype naming convention

[gauravmsharma]

I am dynamically extracting a sourctype using props.conf and tranform.conf file. But the extraction is not working as expected. 

The soucetype i am extracting is "eu_test_splunktest_internal_dev" but it seems the splunk is only displaying "eu_test_ "as a sourctype and it's trimming rest of the part.

Is there a splunk offical page which defines any kind of restriction on sourctype name  or i can have the mentioned name as a sourctype?

[vikramyadav]

If you want to override a source type, you must configure the setting in props.conf on the forwarder where the input is configured.

To override source type assignment, add a stanza for your source to props.conf . In the stanza, identify the source path, using regular expression (regex) syntax for flexibility if necessary. Then specify the source type by including a sourcetype attribute. For example:
[source::.../var/log/abc.log(.\d+)?]
sourcetype=abc

https://docs.splunk.com/Documentation/Splunk/8.0.6/Data/Bypassautomaticsourcetypeassignment

-----------------------------------------------------------
If this helps, your like will be appreciated. 😊

[gauravmsharma]

This is not my query here.

[gcusello]

Hi  @gauravmsharma,

when you say "dynamically extracting a sourctype using props.conf and tranform.conf file", you mean the in the pros.conf stanza title you use the  "eu_test_splunktest_internal_dev", is it correct?

I am not aware that there are limits in the length of the sourcetypes, but for safety you could try to add a sourcetype using the web gui [Settings -- Source types -- New Source type] and see if there's a limit.

For my knowledge the only limit is to not use some special chars like *, ", <, >, etc...

Check the props.conf to see if there aren't spaces in the sourcetype stanza's title.

Ciao.

Giuseppe

[gauravmsharma]

No, i am trying to overide the sourcetype using regex, as available in below documentation.

https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

The source type is override based on the regex which i have written in tranform.conf file.

[gcusello]

Hi @gauravmsharma,

in my knowledge there isn't any reason to trim the sourcetype in overriding.

Have you the same problem using a sourcetype with the same number of chars but without special chars?

e.g.: eutestsplunktestinternaldev1234

If yes, there's an undocumented limit to the number of chars, so I hint to open a Case to Splunk Support.

If not, check the special chars you're using and see if you avoid to use them.

Ciao.

Giuseppe