I would like to set up a splunk forwarder to listen for syslog connections (let's say on port 1514). I know specific source IP addresses which sends a specific sourcetype but for the other, I don't know. So I was thinkg of having an inputs.conf looking like this:
[udp://1.2.3.4:1514]
sourcetype = asm_log
[udp://:1514]
sourcetype = syslog
But won't the two stanzas conflict ? If not, what will be the order of precedence between these 2 stanzas ? Is this order guaranteed to stay the same whatever stanza is in the other config files ? Can I invert the two stanzas and get the same results ?
Hello
They will conflict, and Splunk applies them by lexicographical order,supposing that they are in the same app and the same folder (default or local)
Regards
Hello
They will conflict, and Splunk applies them by lexicographical order,supposing that they are in the same app and the same folder (default or local)
Regards
You are welcome. If they share the incoming port, you´ll need to transform the data and parse the content to select the sourcetype.
@lukejadamec: I knew the link but my question was related to the precedence within a single file which is only documented for props.conf if I'm not mistaken.
@gfuente: thanks, it answers to the question but how can I have splunk listen for any source ip and set the sourcetype for specific ones ? Will I have to use props/transforms ?
This is old now, but this might help someone else.
You can override the sourcetype in the props.conf and transforms.conf. Have a look at this:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Advancedsourcetypeoverrides
Here is the link to the doc that explains configuration precedence:
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Wheretofindtheconfigurationfiles