Splunk Enterprise Security

Problem on Changing Syslog Sourcetype

element1314
New Member

The problem is on changing syslog sourcetype into another one.
I read all splunk answer about it. I am following the instruction that i have been learn from there.
But it is still not success. All new source from udp:514 are still ingest under sourcetype=syslog

What did I do as below:
1. Create a new folder under apps with "splunk" account full access
2. Create a new props.conf and transform.conf under \newapp\local\
3. Props.conf

[syslog]
TRANSFORMS-force_sourcetype_for_newapp = force_sourcetype_for_newapp
  1. Transforms.conf

    [force_source_for_newapp]
    DEST_KEY = MetaData:Sourcetype
    REGEX = newapp
    FORMAT = sourcetype::newapp

Any idea what going wrong?

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Change REGEX = newapp to REGEX = .

In your example, the sourcetype renaming would only happen to events that contain "newapp". REGEX=. means that it will apply to any events that pass through this transform.

Also, in props, you call it force_sourcetype_for_newapp, and in transforms, you call it force_source_for_newapp. They should be the same.

Overall, your file should look like this.

props.conf

[syslog]
TRANSFORMS-force_sourcetype_for_newapp = force_sourcetype_for_newapp

transforms.conf

[force_sourcetype_for_newapp]
DEST_KEY = MetaData:Sourcetype
REGEX = .
FORMAT = sourcetype::newapp

Have you restarted your Splunk instance after this change?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...