How to define a source type

[ethanthomas]

I have a requirement to add new data format to splunk . Below is the sample data . If i want to setup a new sourcetype based on the field 'InputType', what are the changes required in the props.conf file and transforms.conf file ? I want the sourcetype to display the values aMG, zRP or bKL

Sample data

InputType="aMG"|filename <K............

InputType="zRP"{dataformat..>...........

InputType="bKL"$%mo << ........

InputType="aMG"\dataformat.......

[scelikok]

You should put a sourcetype in your inputs.conf. Did you put these props and transforms to indexers? Or if there is a Heavy Forwarder between, you have to put it there. Could you please share your props, transforms and inputs.conf settings? Also infor about your setup, UF, HF and indexers.

[ethanthomas]

I have used exactly the same . However , the sourcetype is still the value defined in the input.conf file . Any issues ? Do i need to change anything in the input .conf file ? I removed the sourcetype in the Input.conf file , but on that case the sourcetype changes to the default value tcp-raw. Please help

[scelikok]

 Hi @ethanthomas,

Below should work for you, please input_sourcetype stanza with yours. 

transforms.conf

[update_sourcetype]
REGEX = InputType=\"([^\"]+)
FORMAT = sourcetype::$1
DEST_KEY = MetaData:Sourcetype

props.conf

[input_sourcetype]
TRANSFORMS-sourcetype_override = update_sourcetype

 For reference your can check below docs link;

https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Advancedsourcetypeoverrides#Override_source_...