Getting Data In

Windows Event Log Sourcetype Overrride

Wallen
Explorer

I have the following on my indexer's props.conf:

[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
sourcetype = WinPrintMon

However, both the source and sourcetype in the events still come up as "WinEventLog:Microsoft-Windows-PrintService/Operational". According to the props.conf documentation I shouldn't have to build a regex and a transform in order to rename this sourcetype.

What am I doing wrong?

Tags (2)
1 Solution

strive
Influencer

Try this:
In transforms.conf
[set_sourcetype_WinEventLog]
REGEX =
FORMAT = sourcetype::WinPrintMon
DEST_KEY = MetaData:Sourcetype

In props.conf
[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
TRANSFORMS-changesourcetype = set_sourcetype_WinEventLog

Note: write your regex

View solution in original post

strive
Influencer

I converted my comment to answer. See if you can add your comment below to the answer

0 Karma

strive
Influencer

Try this:
In transforms.conf
[set_sourcetype_WinEventLog]
REGEX =
FORMAT = sourcetype::WinPrintMon
DEST_KEY = MetaData:Sourcetype

In props.conf
[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
TRANSFORMS-changesourcetype = set_sourcetype_WinEventLog

Note: write your regex

View solution in original post

Wallen
Explorer

It works with a Regex = \w*, however that doesn't explain why the props.conf docs state you don't need a transform when based on source. I'll mark this as the answer anyway. Thanks.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!