I'm having issue overriding sourcetype thro props.conf. my config is on the inputs.conf on a forwarder i'm setting a generic sourcetype of network_device and then overriding that sourcetype on the indexer with props.conf, but it seems to be not working. here's my configs :
inputs.conf on forwarder :
[monitor:///opt/log] host_segment = 3 sourcetype = network_device
props.conf on indexer :
[network_device] TRANSFORMS-sourcetype_cisco_wap = cisco_wap_device
transforms.conf on indexer :
[cisco_wap_device] DEST_KEY = MetaData:Sourcetype REGEX = \:\s(%DOT11)-\d+-\S+ FORMAT = sourcetype::cisco_wap
The events are coming in all right and getting sourcetype'd as networkdevice, but its not source typing as ciscowap. I've also tried using source:: but doesnt work either. I know am making something silly, but cant figure out. tried using splunk cmd btool --debug and it does show transform being used. but why isn't it getting sourcetyped as cisco_wap ?
Any help here will greatly help me.
You did not show an example of your events. Without this we cannot validate your REGEX which is where these kinds of problems usually are (you think your REGEX is correct but it has a bug so that is the problem, not the way you've configured everything else).