Getting Data In

Why am I having sourcetype override problems when trying to monitor a log directory for a custom application?

bdf0506
Path Finder

I have the universal forwarder installed on a Windows 2012 server. I am trying to monitor a log directory for a custom application. The application creates a new log file for each month, so I have many text files in the folder that look like 201808.txt, 201807.txt, 201806.txt, etc.

When I monitor the directory, instead of hardcoding the sourcetype that I am telling splunk to do, it is instead setting the sourcetype to the filename. How can I fix this?

On the Windows Server, inputs.conf:

[monitor://C:\BlueIris\log]
disabled = false
sourcetype = blueiris

On the indexer, props.conf:

[blueiris]
sourcetype = blueiris
0 Karma
1 Solution

bdf0506
Path Finder

I got to the bottom of this.

My original post was actually correct, but I had it in the wrong place, as I was erroneously placing this in $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/local/inputs.conf when it needed to be in $SPLUNK_HOME/etc/apps/search/inputs.conf. You don't need a props.conf defined on either the Windows host or the main Indexer for this to work.

[monitor://C:\BlueIris\log\]
disabled = false
sourcetype = blueiris

View solution in original post

0 Karma

bdf0506
Path Finder

I got to the bottom of this.

My original post was actually correct, but I had it in the wrong place, as I was erroneously placing this in $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/local/inputs.conf when it needed to be in $SPLUNK_HOME/etc/apps/search/inputs.conf. You don't need a props.conf defined on either the Windows host or the main Indexer for this to work.

[monitor://C:\BlueIris\log\]
disabled = false
sourcetype = blueiris
0 Karma

DalJeanis
Legend

The second stanza is redundant. There is no reason to assign sourcetype blueiris to something that comes in as sourcetype blueiris.

Also, sourcetype is not one of the keywords for a monitor stanza.

Try it without assigning sourcetype in that first stanza at all...

...and add a props.conf stanza that sets the sourcetype based on the source, like this...

 [source:://C:\BlueIris\log*]
  sourcetype = blueiris
0 Karma

bdf0506
Path Finder

No change.

I first removed this from props.conf on the INDEXER:

 [blueiris]
 sourcetype = blueiris

Then, I changed the inputs.conf on the Windows Unviersal Forwarder to this:

 [monitor://C:\BlueIris\log]
 disabled = false

And then I added a props.conf file on Windows that shows this:

[source:://C:\BlueIris\log*]
sourcetype = blueiris

But after doing all that, it still is being tagged with the incorrect sourcetype.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...