Why props.conf configurations not taking effect?

[ankireddy007]

Hi,

I am receiving syslog data from various type of devices, but all are on udp:514. I need to overwrite the sourcetype based on Host IP address. Following are the configurations I did, but this is not taking effective. My search result shows sourcetype as [syslog] only.
Can you please help me where I am doing the mistake.

Configurations made in $SPLUNK_HOME/etc/system/local directory

    inputs.conf
        [udp://514]
        connection_host = ip
        source = udp_514
        sourcetype = syslog

    props.conf
        [host::10\.0\.6\.23]
        sourcetype = websense

        [host::10\.0\.6\.113]
        sourcetype = cisco:ios

[strive · Accepted solution]

This link will help you

http://answers.splunk.com/answers/3687/host-stanza-in-propsconf-not-being-honored-for-udp514-data-so...

You set the sourcetype in transforms.conf and then use that in props.conf file

[strive]

Check the sourcetype configuration section in http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf

[ankireddy007]

Thaks Strive, Its working.
But any idea why settings in props.conf alone (without transforms.conf) not working.

[ankireddy007]

HI Strive,

Here no forwarders in this deployment, as all syslog devices sending data on udp:514. I have splunk indexer acting as syslog server to receive on udp:514.
All configurations made in Splunk INDEXER. (system/local directory)
Yes I am seeing different hosts (IPs) on search

Thansk, Anki

[strive]

Where do you have your props.conf? Is it on forwarder or indexer? what type of forwarder are you using? In your search results are you seeing different IP addresses as hosts?