Why is Splunk_TA_nix not using default sourcetypes for /var/log/messages?

[daniel333]

All,

I have a relatively default setup for Splunk_TA_nix on centOS 7 and /var/log/messages is coming in as sourcetype=syslog. How ever when I review the pretrained sourcetypes docs here I see that is not the correct sourcetype https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Listofpretrainedsourcetypes

Any idea what's up? Any reason I shouldn't configure this to be sourcetype=linux_messages_syslog?

thanks,
-Daniel Wilson

[oscar84x]

If you look at the respective props and transforms for those sourcetypes, it looks like the nix add on is extracting more detailed information out of the data under the syslog sourcetype.

FROM NIX ADD-ON

###### Syslog ######
[source::....syslog]
sourcetype = syslog

[syslog]
EVENT_BREAKER_ENABLE = true

## Event extractions by type
REPORT-0authentication_for_syslog = ssh-login-events, ssh-session-close, ssh-disconnect, sshd_authentication_kerberos_success, sshd_authentication_refused, sshd_authentication_tried, sshd_login_restricted, pam_unix_authentication_success, pam_unix_authentication_failure, sudo_cannot_identify, ksu_authentication, ksu_authorization, su_simple, su_authentication, su_successful, wksh_authentication, login_authentication
EVAL-action = if(app="su" AND isnull(action),"success",action)
REPORT-account_management_for_syslog = useradd, userdel
REPORT-firewall = ipfw, ipfw-stealth, ipfw-icmp, pf
REPORT-routing = iptables
EVAL-signature = if(isnotnull(inbound_interface),"firewall",null())
REPORT-signature_for_syslog_timesync = signature_for_nix_timesync

REPORT-dest_for_syslog = host_as_dest
LOOKUP-action_for_syslog = nix_action_lookup vendor_action OUTPUTNEW action
REPORT-src_for_syslog = src_dns_as_src, src_ip_as_src, host_as_src

FROM SPLUNK PRETRAINED

[linux_messages_syslog]
pulldown_type = 1
MAX_TIMESTAMP_LOOKAHEAD = 32
TIME_FORMAT = %b %d %H:%M:%S
TRANSFORMS = syslog-host
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False
category = Operating System
description = Format found within the Linux log file /var/log/messages