order of precedence and conflicts in input.conf

[yoho]

I would like to set up a splunk forwarder to listen for syslog connections (let's say on port 1514). I know specific source IP addresses which sends a specific sourcetype but for the other, I don't know. So I was thinkg of having an inputs.conf looking like this:

[udp://1.2.3.4:1514]
sourcetype = asm_log

[udp://:1514]
sourcetype = syslog

But won't the two stanzas conflict ? If not, what will be the order of precedence between these 2 stanzas ? Is this order guaranteed to stay the same whatever stanza is in the other config files ? Can I invert the two stanzas and get the same results ?

[gfuente · Accepted solution]

Hello

They will conflict, and Splunk applies them by lexicographical order,supposing that they are in the same app and the same folder (default or local)

Regards

[gfuente]

You are welcome. If they share the incoming port, you´ll need to transform the data and parse the content to select the sourcetype.

[yoho]

@lukejadamec: I knew the link but my question was related to the precedence within a single file which is only documented for props.conf if I'm not mistaken.

@gfuente: thanks, it answers to the question but how can I have splunk listen for any source ip and set the sourcetype for specific ones ? Will I have to use props/transforms ?

[BlueSocket]

This is old now, but this might help someone else.
You can override the sourcetype in the props.conf and transforms.conf. Have a look at this:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Advancedsourcetypeoverrides

[lukejadamec]

Here is the link to the doc that explains configuration precedence:
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Wheretofindtheconfigurationfiles