Getting Data In

Windows Event Log Sourcetype Overrride

Wallen
Explorer

I have the following on my indexer's props.conf:

[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
sourcetype = WinPrintMon

However, both the source and sourcetype in the events still come up as "WinEventLog:Microsoft-Windows-PrintService/Operational". According to the props.conf documentation I shouldn't have to build a regex and a transform in order to rename this sourcetype.

What am I doing wrong?

Tags (2)
1 Solution

strive
Influencer

Try this:
In transforms.conf
[set_sourcetype_WinEventLog]
REGEX =
FORMAT = sourcetype::WinPrintMon
DEST_KEY = MetaData:Sourcetype

In props.conf
[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
TRANSFORMS-changesourcetype = set_sourcetype_WinEventLog

Note: write your regex

View solution in original post

strive
Influencer

I converted my comment to answer. See if you can add your comment below to the answer

0 Karma

strive
Influencer

Try this:
In transforms.conf
[set_sourcetype_WinEventLog]
REGEX =
FORMAT = sourcetype::WinPrintMon
DEST_KEY = MetaData:Sourcetype

In props.conf
[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
TRANSFORMS-changesourcetype = set_sourcetype_WinEventLog

Note: write your regex

View solution in original post

Wallen
Explorer

It works with a Regex = \w*, however that doesn't explain why the props.conf docs state you don't need a transform when based on source. I'll mark this as the answer anyway. Thanks.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!