Trying to override a syslog UDP sourcetype based on a host naming convention; not working

[mjones414]

I've read many threads and tried multiple examples on this and am getting nowhere. first some history on the issue:

I have some NAS devices that have the ability to forward their local logs to a syslog server, but I have no control over the UDP port. So all this data is going directly into UDP/514 on the splunk server along with data from a few hundred linux hosts. Now I've been able to set event types for the NAS devices but I cannot extract fields against event types, so what I am trying to do is either:

a) write all the netapp data to a different index or

b) override the sourcetype to have something I can write transforms against

I've seen many examples for both but I haven't successfully gotten any of them to work.

The part of the naming convention I want to key off of is simple enough, I am looking for the word "nas" somewhere in the hostname. I've tried setting the following in props.conf:

[host::nas]
sourcetype = syslog_nas

and I've also tried the following in transforms.conf, both at the etc/system/local level

[nas_set_sourcetype]
SOURCE_KEY = MetaData:Host
DEST_KEY = MetaData:Sourcetype
REGEX = ^host::.nas.
FORMAT = syslog_nas

Can someone please point me in the correct direction? Any help is greatly appreciated!

[adamw · Accepted solution]

If you're looking for the host to match anything with nas in the name, you'll have to break out some regex to match that. Something like:

[host:.nas.]

See http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf for information regarding matching these keys in props.

Thanks,
--adam

[mjones414]

Thank you! Problem was in props.conf in how I was referencing the transform. All is working now!

[jonuwz]

I think your missing a field name in the format.

FORMAT = sourcetype::syslog_nas

Here's an example

[mjones414]

Thanks jonuwz, I've made the correction but it doesn't seem to have made a difference. 😞 whenever I search for sourcetype=syslog_nas, I'm still getting no results, but if I change it to eventtype=nas, I have hundreds coming in real time.

[mjones414]

I don't know why but my asterisks are getting lost in the posting it should be but nas in both areas are surrounded by asterisks