Getting Data In

sourcetype=tcp-raw

pmr
Explorer

I'm using a forwarder (regular) to forward TCP input to indexer. The events are being forwarded correctly to the indexer, but for some reason its assigning sourcetype=tcp-raw even though i've specified props and transforms on the indexer. here's my configs :

on forwarder : inputs.conf

[tcp://9996]
disabled = false
connection_host = ip

on forwarder : outputs.conf

[tcpout]
defaultGroup=my_indexer
compressed=false
indexAndForward=false

[tcpout:my_indexer]
compressed=false
server=192.168.77.1:9997

on indexer where props and transforms is occuring : props.conf

[source::tcp:9996]
TRANSFORMS-sourcetyping_testlog = test_log
TRANSFORMS-indexrouting_testlog = testlog_index

and my transforms.conf

[test_log]
DEST_KEY = MetaData:Sourcetype
REGEX = solaris-new
FORMAT = sourcetype::test_newlog

[testlog_index]
DEST_KEY = _MetaData:Index
REGEX = solaris-new
FORMAT = testlog

i didnt want to set sourcetype on forwarder itself using inputs.conf or props/transforms as i wanted to perform all transformations on the indexer. The events are coming thro correctly to the indexer but sourcetype=tcp-raw is being assigned.

can i get some help on this ?

cheers pmr

Tags (1)
0 Karma

Andreux
Splunk Employee
Splunk Employee

"tcp-raw" is the default sourcetype for a source::tcp (RAW TCP) input, so any transforms are not matching the data.

0 Karma

willthames
Path Finder

Looking at http://www.splunk.com/base/Documentation/4.1.7/admin/Aboutdefaultfields#Methods_Splunk_uses_for_sour...

in props.conf you could have

[source::tcp:9996]
sourcetype=testlog

and that should work

0 Karma

pmr
Explorer

I could have done that, but can't since i'll have events coming in from different devices on the same tcp port which needs different sourcetypes to be set according to regex. so i'll need a transforms.conf to set sourcetype.

curious to know from where tcp-raw sourcetype is being set.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...