Getting Data In

How to override the props source?

coreyf311
Path Finder

I have the below configured but source is not being over written. I am trying to wild card anything after Windows in the path.

props.conf

[source::/var/log/Windows/*]
TRANSFORMS-changesource=changesource

transforms.conf

[changesource]
FORMAT= source::WinEventLog:Security
DEST_KEY=MetaData:Source

I have it deployed to my heavy forwarder. It's not working there. I am also curious if I can deploy something like this to a Universal Forwarder after I am sure the syntax is correct?

0 Karma
1 Solution

FrankVl
Ultra Champion

If you have further sub-directories behind /var/log/Windows/, you need to use the ... wildcard instead of *. So try [source::/var/log/Windows/...] instead.

And no, these operations cannot be done on UF. Unless this specific source value matches a specific inputs.conf stanza, then you could set the source field as part of the inputs.conf.

View solution in original post

0 Karma

FrankVl
Ultra Champion

If you have further sub-directories behind /var/log/Windows/, you need to use the ... wildcard instead of *. So try [source::/var/log/Windows/...] instead.

And no, these operations cannot be done on UF. Unless this specific source value matches a specific inputs.conf stanza, then you could set the source field as part of the inputs.conf.

0 Karma

coreyf311
Path Finder

I would prefer to set source as part of the inputs.conf Can I override the source in inputs.conf?

0 Karma

coreyf311
Path Finder

the current sources are /var/log/LOGCENTRAL/Windows/hostname/hostname.log. This obviously varies as there are many hosts writing logs. My props is now [source::/var/log/LOGCENTRAL/Windows/...] and thats not working either.

0 Karma

FrankVl
Ultra Champion

I think you need to add a REGEX = . to your transforms.conf. That setting is required for index-time extractions like this. Sorry for not catching that earlier.

0 Karma

FrankVl
Ultra Champion

Yes, you can simply add source = WinEventLog:Security to the relevant inputs.conf stanza.

0 Karma

coreyf311
Path Finder

a simple read of the inputs.conf spec gave me the answer 🙂 Thanks!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...