How to reset sourcetype and do field extractions using props.conf and/or transforms.conf?

[deepak02]

My Splunk setup has 3 layers,

1. Forwarders - 50+
2. Indexers - 4, running on different machines
3. Search Heads - 3, running on different machines

Question 1: Resetting the sourcetype
Logs are being assigned the sourcetype set in inputs.conf of the forwarders. I want to change it to a different sourcetype.

Since the forwarders are being owned by a different team and they are not willing to make changes, I will need to reset the sourcetype using props.conf and transforms.conf.

Can I reset the sourcetype at the Search Head? Or should I do it at the indexer? - Which is better?

Question 2: Fields extractions
I need to extract four fields using props.conf.
Can I do these extractions at the Search Head (the preferred option)? Or should I do it at the indexer only?

Note: I am using Splunk Enterprise

Thanks,
Deepak

[woodcock]

Resetting it at the Indexer is "better" because it actually changes the sourcetype but you can also pretend that the sourcetype has been changed and refer to it by a new name by using the sourcetype rename configuration on the Search Head:

https://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Renamesourcetypes

[alemarzu]

Hello @deepak02

A) For sourcetype renaming you can do this.
Add to your props.conf on your indexer/s.

[your_sourcetype]
TRANSFORMS-sourcetype_renaming = renaming_old_sourcetype

Add to your transforms.conf on your indexer/s.

[renaming_old_sourcetype]
SOURCE_KEY = MetaData:Source
REGEX = <regex matching your source of events>
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::<new_sourcetype>

B) You should read this pages of Splunk documentation: http://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Createandmaintainsearch-timefieldextract...

Hope it helps.