Getting Data In

sourcetype based upon host

Champion

Hi,

I have a logfile that contains lots of hosts (coming in from syslog). I want to dynamically change the sourcetype based upon the host value. (It has to be host, not just text in the stream). Is this possible? Not that there are numerous other inputs coming in on this system, some of which also contain these same hosts, but I don't want them included in this setup.

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

You can match a host in props.conf and set a source type. Host stanzas override sourcetype stanza.

[syslog]

blah blah

[host::myserver*]
sourcetype=special_sourcetype

Even though the event came in as syslog, as long as the host stanza matches it will override syslog.

Here is the props.conf spec for more info:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

View solution in original post

Splunk Employee
Splunk Employee

You can match a host in props.conf and set a source type. Host stanzas override sourcetype stanza.

[syslog]

blah blah

[host::myserver*]
sourcetype=special_sourcetype

Even though the event came in as syslog, as long as the host stanza matches it will override syslog.

Here is the props.conf spec for more info:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

View solution in original post

Champion

Thanks. Yes, I'm doing that on a linux system, but this is legacy stuff running on Solaris, and uses standard syslog daemons. Thanks for all the info.

0 Karma

Splunk Employee
Splunk Employee

Unfortunately I do not know of a way to do this based on a lookup.

One thing I would say though is that sometimes it is easier to fix this on the way in rather than trying to fix it in Splunk.

Many times people will have their syslog receiver split out the syslog into different directories based on hosts and then you would just configure the SPlunk forwarder to map these directories to source types.

Champion

Thanks. One last question - would it be possible to do this based upon a lookup? I did a search, but I don't see any examples of this being done.

0 Karma

Splunk Employee
Splunk Employee

ok, if you need it dependent you can try this.

props.conf

[syslog]
TRANSFORMS-setsourcetype = setsourcetype

transforms.conf

[setsourcetype]
FORMAT = new
sourcetype
REGEX = myserver
SOURCEKEY = MetaData:Host
DEST
KEY = MetaData:Sourcetype

0 Karma

Explorer
0 Karma

Champion

Is the host stanza a sub-set of the syslog stanza? I have other inputs that will have the same hosts, but I don't want those modified.

0 Karma