Splunk Search

How to define a source type

ethanthomas
Path Finder

I have a requirement to add new data format to splunk . Below is the sample data . If i want to setup a new sourcetype based on the field 'InputType', what are the changes required in the props.conf file and transforms.conf file ? I want the sourcetype to display the values aMG, zRP or bKL

Sample data

InputType="aMG"|filename <K............

InputType="zRP"{dataformat..>...........

InputType="bKL"$%mo << ........

InputType="aMG"\dataformat.......

 

 

 

 

 

Labels (1)
Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

You should put a sourcetype in your inputs.conf. Did you put these props and transforms to indexers? Or if there is a Heavy Forwarder between, you have to put it there. Could you please share your props, transforms and inputs.conf settings? Also infor about your setup, UF, HF and indexers.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

ethanthomas
Path Finder

I have used exactly the same . However , the sourcetype is still the value defined in the input.conf file . Any issues ? Do i need to change anything in the input .conf file ? I removed the sourcetype in the Input.conf file , but on that case the sourcetype changes to the default value tcp-raw. Please help

0 Karma

scelikok
SplunkTrust
SplunkTrust

 Hi @ethanthomas,

Below should work for you, please input_sourcetype stanza with yours. 

transforms.conf

[update_sourcetype]
REGEX = InputType=\"([^\"]+)
FORMAT = sourcetype::$1
DEST_KEY = MetaData:Sourcetype

props.conf

[input_sourcetype]
TRANSFORMS-sourcetype_override = update_sourcetype

 For reference your can check below docs link;

https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Advancedsourcetypeoverrides#Override_source_... 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...