Getting Data In

override source field to a common source using transform.conf and props.conf

meet_vadaria
Engager

Hi

I want to have a common source field for all my syslog. I have centralized syslog server where I am running splunkforwarder to send all remote hosts logs to splunk.

currently source filed is default which is "/var/log/syslog/%year%/%month%/%date%/%host%/syslog"
what I want is "/var/log/syslog" - I want this static for all logs. how to do this with transforms.conf and props.conf

I know I can do it in input.conf by just mentioning source="/var/log/syslog". I tried that and it works but it's breaking host field. I am overriding host field using host_segment in input.conf. so if I put static source there it breaks host_segment and splunk can't parse host.

current configs,

transform.conf
[source]
FORMAT = source::/var/log/syslog
SOURCE_KEY=MetaData:Source
DEST_KEY = MetaData:Source

props.conf
[sourceoverride]
TRANSFORMS-source = source
SHOULD_LINEMERGE = false

input.conf
[monitor:///var/log/rsyslog/////syslog]
disabled = false
followTail=0
host_segment = 7
blacklist = .(gz)$
sourcetype = syslog

source=/var/log/syslog

0 Karma

FrankVl
Ultra Champion

Your transforms.conf is missing the REGEX part. Even though you don't need it functionally, it is a mandatory setting for indextime transforms.

So just add REGEX = . and then I think it should work.

0 Karma

meet_vadaria
Engager

Just tried this. didn't work. Somehow it seems like splunk is ignoring transforms and props config files. no effect at all.

0 Karma

FrankVl
Ultra Champion

Did you try my suggestion combined with the other answer about using [syslog]?

Because using [sourceoverride] in your props.conf is incorrect. You need to put your actual sourcetype between de square brackets not some
random word.

0 Karma

p_gurav
Champion

Can you try props as below:

props.conf
[syslog]
TRANSFORMS-source = source
SHOULD_LINEMERGE = false
0 Karma

meet_vadaria
Engager

tried your suggestion, didn't work. no effect.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...