Transform for sourcetype issue

[LiquidTension]

I am trying to make a minor update to take some data that is coming in via syslog and change the sourcetype to infoblox_dns and the move it to the network index but having issues getting splunk to recognize it. What am I doing wrong!?

transforms.conf:

[mc_force_sourcetype_for_infoblox_dns]
REGEX = (\d+\.\d+\.\d+\.\d+\s(named|dhcpd|lbsyncd|lbsync_f5)|\[\d+\]\:|\d+\.\d+\.\d+\.\d+\s(lbsync_f5|Available\sLeases|Total\sAddresses|Active\sLeases|Current\sUsage|High\sReset\sMark|High\sTrigger\sMark|Low\sReset\sMark|Low\sTrigger\sMark|Range|Network|Member|kernel|serial_console|/infoblox/one/bin/rotate_syslog)\:)
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::infoblox_dns

[mc_force_index_for_infoblox_dns]
SOURCE_KEY = MetaData:Sourcetype
REGEX = (infoblox_dns)
DEST_KEY = _MetaData:Index
FORMAT = network

Props.conf:
[syslog]
TIME_FORMAT = %b %d %H:%M:%S
TIME_PREFIX = ^
SHOULD_LINEMERGE = false
TRUNCATE = 1000000
KV_MODE = none
ANNOTATE_PUNCT = false
LINE_BREAKER = ([\n\r]+)

TRANSFORMS-2_syslog_sourcetypes = mc_force_sourcetype_for_infoblox_dns
TRANSFORMS-3_syslog_index = mc_force_index_for_infoblox_dns

[splunk@host ~]$ splunk cmd btool transforms list --debug | grep infoblox | less

/opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf          [mc_force_index_for_infoblox_dns]
/opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf          REGEX = (infoblox_dns)
/opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf          [mc_force_sourcetype_for_infoblox_dns]
/opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf          FORMAT = sourcetype::infoblox_dns
/opt/splunk/etc/slave-apps/mc_all_syslog_props/local/transforms.conf          REGEX = (\d+\.\d+\.\d+\.\d+\s(named|dhcpd|lbsyncd|lbsync_f5)|\[\d+\]\:|\d+\.\d+\.\d+\.\d+\s(lbsync_f5|Available\sLeases|Total\sAddresses|Active\sLeases|Current\sUsage|High\sReset\sMark|High\sTrigger\sMark|Low\sReset\sMark|Low\sTrigger\sMark|Range|Network|Member|kernel|serial_console|/infoblox/one/bin/rotate_syslog)\:)

[Runals]

2 thoughts depending on how your environment is setup. Out of curiosity have you restarted your indexer(s) after making your change or the one proposed to somesoni2? If that data is being handled by a heavy forwarder the props/transforms will need to be pushed to it.

[LiquidTension]

I did issue a rolling restart command after pushing the change via the cluster master and that did not resolve the problem. I will give somesoni2's suggest a shot here later today.

[somesoni2]

Try this in your transforms.conf

 [mc_force_sourcetype_for_infoblox_dns]
 REGEX = (\d+\.\d+\.\d+\.\d+\s(named|dhcpd|lbsyncd|lbsync_f5)|\[\d+\]\:|\d+\.\d+\.\d+\.\d+\s(lbsync_f5|Available\sLeases|Total\sAddresses|Active\sLeases|Current\sUsage|High\sReset\sMark|High\sTrigger\sMark|Low\sReset\sMark|Low\sTrigger\sMark|Range|Network|Member|kernel|serial_console|/infoblox/one/bin/rotate_syslog)\:)
 DEST_KEY = MetaData:Sourcetype
 FORMAT = sourcetype::infoblox_dns

 [mc_force_index_for_infoblox_dns]
REGEX = (\d+\.\d+\.\d+\.\d+\s(named|dhcpd|lbsyncd|lbsync_f5)|\[\d+\]\:|\d+\.\d+\.\d+\.\d+\s(lbsync_f5|Available\sLeases|Total\sAddresses|Active\sLeases|Current\sUsage|High\sReset\sMark|High\sTrigger\sMark|Low\sReset\sMark|Low\sTrigger\sMark|Range|Network|Member|kernel|serial_console|/infoblox/one/bin/rotate_syslog)\:)
 DEST_KEY = _MetaData:Index
 FORMAT = network

[LiquidTension]

This unfortunately did not work either after making the change and restarting the indexers. The data is still coming in

index=main, sourcetype=syslog

[LiquidTension]

Any other ideas or something standing out that I am doing wrong?