Getting Data In

How can I put that source in props.conf without listing each one separately?

leejones4
Explorer

We are trying to filter out events from a Syslog server that is ingesting data for a number of sources but the one we are trying to filter is from our Meraki devices.  Each Meraki is considered a source and the sourcetype is meraki.  This is a sample of the events coming into Splunk:

2022-07-08 07:14:51.427 xxx.xxx.xxx.xxx 1 Location_XXX flows src=xxx.xxx.0.1 dst=8.8.8.8 mac=70:D3:79:XX:XX:XX protocol=icmp type=8 pattern: allow icmp
host = xxx.xx.0.2source = /syslog0/syslog/meraki/xxx.xx.0.2/messages.log sourcetype = meraki

There are more than 100 sources all using the format:  /syslog0/syslog/meraki/<IP Address>/messages.log

How can I put that source in props.conf without listing each one separately? 

Labels (1)
0 Karma
1 Solution

danielcj
Communicator

Yes, you can use the sourcetype on the props.conf instead of the sources. 
You can check it on the docs: 

https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf#GLOBAL_SETTINGS

[<spec>]
* This stanza enables properties for a given <spec>.

<spec> can be:
1. <sourcetype>, the source type of an event.

 

View solution in original post

danielcj
Communicator

Hello @leejones4 ,

You could use the sourcetype definition instead of the sources on the props.conf file

For example:

props.conf file

[meraki]
<YOUR_DEFINITIONS_HERE>

leejones4
Explorer

That's awesome.  So I don't need to put the source but can use the sourcetype instead?

0 Karma

danielcj
Communicator

Yes, you can use the sourcetype on the props.conf instead of the sources. 
You can check it on the docs: 

https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf#GLOBAL_SETTINGS

[<spec>]
* This stanza enables properties for a given <spec>.

<spec> can be:
1. <sourcetype>, the source type of an event.

 

Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...