Changing sourcetype with regex

[ddarmand]

I try this in transforms.conf :

[Hirschmann]
DEST_KEY = MetaData:Sourcetype
REGEX =  "\S[A-Z]+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-.\s[A-Z0-9_]+\[[0-9]+\]:\s[a-z0-9_/.]+\([0-9]+\)\s[0-9]+\s%%\s.+"
FORMAT = sourcetype::Hirschmann

(the regex is working when i use * | regex "\S[A-Z]+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-.\s[A-Z0-9_]+\[[0-9]+\]:\s[a-z0-9_/.]+\([0-9]+\)\s[0-9]+\s%%\s.+"
in search bar)

but it's still marked "syslog" on sourcetype

Can you help me ?

[dart · Accepted solution]

You'll need a corresponding props.conf entry, do you have one? It should look roughly like this:

## props.conf
[syslog]
TRANSFORM-force-sourcetype-hirschmann = Hirshmann

Additionally you shouldn't quote your REGEX:

## transforms.conf
[Hirschmann]
DEST_KEY = MetaData:Sourcetype
REGEX =  \S[A-Z]+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-.\s[A-Z0-9_]+\[[0=9]+\]:\s[a-z0-9_/.]+\([0-9]+\)\s[0-9]+\s%%\s.+
FORMAT = sourcetype::Hirschmann

[kristian_kolb]

Hi, this config setting should go on the first splunk instance that performs parsing. Normally this is either a Heavy Forwarder or an Indexer. See more here;

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

If you're still not getting any data transformed to the Hirschmann sourcetype, you should probably look closer at the regex. It seems a bit complicated, and there might be easier ways of writing it.

/K

[ddarmand]

it's not working, i have multiple index, does this count ? also i have forwarders and i am on my main splunk, maybe i need to add this on the right forwarder ?