Getting Data In

Trying to override a syslog UDP sourcetype based on a host naming convention; not working

mjones414
Contributor

I've read many threads and tried multiple examples on this and am getting nowhere. first some history on the issue:

I have some NAS devices that have the ability to forward their local logs to a syslog server, but I have no control over the UDP port. So all this data is going directly into UDP/514 on the splunk server along with data from a few hundred linux hosts. Now I've been able to set event types for the NAS devices but I cannot extract fields against event types, so what I am trying to do is either:

a) write all the netapp data to a different index or

b) override the sourcetype to have something I can write transforms against

I've seen many examples for both but I haven't successfully gotten any of them to work.

The part of the naming convention I want to key off of is simple enough, I am looking for the word "nas" somewhere in the hostname. I've tried setting the following in props.conf:

[host::nas]
sourcetype = syslog_nas

and I've also tried the following in transforms.conf, both at the etc/system/local level

[nas_set_sourcetype]
SOURCE_KEY = MetaData:Host
DEST_KEY = MetaData:Sourcetype
REGEX = ^host::.nas.
FORMAT = syslog_nas

Can someone please point me in the correct direction? Any help is greatly appreciated!

Tags (1)
0 Karma
1 Solution

adamw
Communicator

If you're looking for the host to match anything with nas in the name, you'll have to break out some regex to match that. Something like:

[host:.nas.]

See http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf for information regarding matching these keys in props.

Thanks,
--adam

View solution in original post

0 Karma

adamw
Communicator

If you're looking for the host to match anything with nas in the name, you'll have to break out some regex to match that. Something like:

[host:.nas.]

See http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf for information regarding matching these keys in props.

Thanks,
--adam

0 Karma

mjones414
Contributor

Thank you! Problem was in props.conf in how I was referencing the transform. All is working now!

0 Karma

jonuwz
Influencer

I think your missing a field name in the format.

FORMAT = sourcetype::syslog_nas

Here's an example

0 Karma

mjones414
Contributor

Thanks jonuwz, I've made the correction but it doesn't seem to have made a difference. 😞 whenever I search for sourcetype=syslog_nas, I'm still getting no results, but if I change it to eventtype=nas, I have hundreds coming in real time.

0 Karma

mjones414
Contributor

I don't know why but my asterisks are getting lost in the posting it should be but nas in both areas are surrounded by asterisks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...