sourcetype override

[pmr]

I'm having issue overriding sourcetype thro props.conf. my config is on the inputs.conf on a forwarder i'm setting a generic sourcetype of network_device and then overriding that sourcetype on the indexer with props.conf, but it seems to be not working. here's my configs :

inputs.conf on forwarder :

[monitor:///opt/log]
host_segment = 3
sourcetype = network_device

props.conf on indexer :

[network_device]
TRANSFORMS-sourcetype_cisco_wap = cisco_wap_device

transforms.conf on indexer :

[cisco_wap_device]
DEST_KEY = MetaData:Sourcetype
REGEX = \:\s(%DOT11)-\d+-\S+
FORMAT = sourcetype::cisco_wap

The events are coming in all right and getting sourcetype'd as network_device, but its not source typing as cisco_wap. I've also tried using source:: but doesnt work either. I know am making something silly, but cant figure out. tried using splunk cmd btool --debug and it does show transform being used. but why isn't it getting sourcetyped as cisco_wap ?

Any help here will greatly help me.

thanks
pmr

[crt89]

Just want to say I did this process and I have managed to override the forwarder's sourcetype to my indexer. Thanks

[gkanapathy]

If the forwarder is a Heavy (vs Light or Universal) forwarder, then the transforms (and the config files) must be on the forwarder rather than the indexer.

See here for details.

[woodcock]

You did not show an example of your events. Without this we cannot validate your REGEX which is where these kinds of problems usually are (you think your REGEX is correct but it has a bug so that is the problem, not the way you've configured everything else).