Getting Data In

sourcetype not getting overridden

abhayneilam
Contributor

I have an inputs.conf
[monitor:///tmp/a.txt]
index=a
sourcetype=AA

Now,I want to over write the sourcetype in HF as mentioned in the Splunk docs.
props.conf
[source::/tmp/a.txt]
SHOUlD_LINEMERGE=false
sourcetype=BB

But, my sourcetype is not getting over written, I am getting the same sourcetype as AA in my IDX server. How to correct it

0 Karma

somesoni2
Revered Legend

You'd have to use the transforms to update the sourcetype metadata, like this

props.conf

[source::/tmp/a.txt]
SHOUlD_LINEMERGE=false
TRANSFORMS-overridest = override_st

transforms.conf

[override_st]
REGEX = .
FORMAT = sourcetype::BB
DEST_KEY = MetaData:Sourcetype

This will be your reference Splunk documentation for the same: http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Advancedsourcetypeoverrides

abhayneilam
Contributor

Do I have to make it HF ? or IDX ? ...

0 Karma

somesoni2
Revered Legend

Whichever comes first in data from source. Generally if you're using HF, before index, set this up in HF. A restart of splunkd service would be required and it'd only affect the new events that come after you set this up.

0 Karma

abhayneilam
Contributor

If I have UF---HF---IDX then ?

0 Karma

somesoni2
Revered Legend

Still in HF (first Splunk Enterprise instance in the flow, after UF first Splunk Enterprise instance is HF, so HF).

0 Karma

abhayneilam
Contributor

No , it is not working .

sourcetype is not getting renamed in HF. But If I do in IDX it is working ..

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...