Getting Data In

Same data input two apps?

token2
Path Finder

Is it possible to share a sourcetype'd data between two apps?

I have pfsense sending both firewall logs and Suricata eve json logs to the same UDP data input.  The TA-pfsense app is sourcetyping, field extracting and indexing the various syslog types from pfsense.  The TA-Suricata has the props.conf, lookups, eventtypes etc to extract relevant data from the eve json logs mixed into this UDP data stream. 

Is there a way to send the sourcetype:suricata from the TA-pfsense props to point to the TA-Suricata inputs.conf?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One should not send two different sourcetypes to the same input port because, as you've learned, it can be very difficult to distinguish them later.  I recommend you do everything in your power to have the two sources arrive at two different ports.

If that is not possible then all is not necessarily lost.  I hope you are using, as is considered Best Practice, a syslog server to receive the UDP inputs.  You may be able to configure the syslog server to write the different sourcetypes to different files based upon the source addresses.  Then Splunk's universal forwarder can read each file and know each source type from the file location.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

One should not send two different sourcetypes to the same input port because, as you've learned, it can be very difficult to distinguish them later.  I recommend you do everything in your power to have the two sources arrive at two different ports.

If that is not possible then all is not necessarily lost.  I hope you are using, as is considered Best Practice, a syslog server to receive the UDP inputs.  You may be able to configure the syslog server to write the different sourcetypes to different files based upon the source addresses.  Then Splunk's universal forwarder can read each file and know each source type from the file location.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...