Getting Data In

override source field to a common source using transform.conf and props.conf

meet_vadaria
Engager

Hi

I want to have a common source field for all my syslog. I have centralized syslog server where I am running splunkforwarder to send all remote hosts logs to splunk.

currently source filed is default which is "/var/log/syslog/%year%/%month%/%date%/%host%/syslog"
what I want is "/var/log/syslog" - I want this static for all logs. how to do this with transforms.conf and props.conf

I know I can do it in input.conf by just mentioning source="/var/log/syslog". I tried that and it works but it's breaking host field. I am overriding host field using host_segment in input.conf. so if I put static source there it breaks host_segment and splunk can't parse host.

current configs,

transform.conf
[source]
FORMAT = source::/var/log/syslog
SOURCE_KEY=MetaData:Source
DEST_KEY = MetaData:Source

props.conf
[sourceoverride]
TRANSFORMS-source = source
SHOULD_LINEMERGE = false

input.conf
[monitor:///var/log/rsyslog/////syslog]
disabled = false
followTail=0
host_segment = 7
blacklist = .(gz)$
sourcetype = syslog

source=/var/log/syslog

0 Karma

FrankVl
Ultra Champion

Your transforms.conf is missing the REGEX part. Even though you don't need it functionally, it is a mandatory setting for indextime transforms.

So just add REGEX = . and then I think it should work.

0 Karma

meet_vadaria
Engager

Just tried this. didn't work. Somehow it seems like splunk is ignoring transforms and props config files. no effect at all.

0 Karma

FrankVl
Ultra Champion

Did you try my suggestion combined with the other answer about using [syslog]?

Because using [sourceoverride] in your props.conf is incorrect. You need to put your actual sourcetype between de square brackets not some
random word.

0 Karma

p_gurav
Champion

Can you try props as below:

props.conf
[syslog]
TRANSFORMS-source = source
SHOULD_LINEMERGE = false
0 Karma

meet_vadaria
Engager

tried your suggestion, didn't work. no effect.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...