...s both timestamps do not contain the year, splunk does not manage to correctly index the events.
I therefore override both sourcetypes onaper-eventbasis.
In props.conf:
[source::.../e...
...type. Let's say that property is named code .
In the corresponding Splunk configuration, I use a transform that uses the value of the code property to overridesourcetypesonaper-eventbasis...
I've implemented per-eventsourcetypesassignment as described here: http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Advancedsourcetypeoverrides Basically it works. For events matching a R...
...uestion: I'm sending a wide variety of sourcetypes to Splunk via EC, using the "sourcetype" key in the event metadata. For TCP, I believe I'll have to overrride sourcetypesonaper-eventbasisas d...
...otoring the log file.
The purpose is that i need to assign different sourcetype to each of them.
Also, is this possible to be done at in rsyslog which is acting as my centralized syslog server.
I h...
...s always "encore". To cheekily resolve that, I tried to alias on the heavy forwarder the sensor field to source (in the estreamer TA), and also on the search head thusly:
FIELDALIAS-e...
...nterface, I can see more types of events being sent on the wire: dhcpd, nginx, unbound, etc. When doing a search for these events, 'index=fw dhcpd' or 'index=fw nginx', zero (0) events are returned. So it's n...
...athToLogs/*/fixedPath/logForSourcetype2*.log]
The goal here is to read the host and sourcetype for the given input.
- host: through host_segment (first * in the stanzas)
- sourcetype: t...
I know that I can overridesourcetypes dynamically perevent based on this documentation link here: (docs.splunk.com/Documentation/Splunk/6.2.5/Data/Advancedsourcetypeoverrides)
I'm reading event...
...ike it should be valid - it may not be, please correct me.
I'm looking to apply this depending on the raw text of the event, so my sourcetype isn't fixed and can't be set in inputs.conf.
Is source...