Getting Data In

Setting custom sourcetypes on 'managed' universal forwarder

Path Finder

I struggling getting my props.conf to work now that i have moved to a universal forwarder.

On previous versions of the forwarder, I have had set sourcetypes based as follows in props.conf:

sourcetype = cloudfront_rtmp

That worked great, but was creating a management challenge as the number of machines grew each with their own custom sourcetypes.

To address this. I am attempting to use the configuration deployment capabilities of Splunk.

So, I created an app called 'forwarder' on the deployment server and added my custom props.conf above.


And I created the appropriate stanzas in serverclass.conf to target the machine in question.

And I verified that the 'forwarder' app is getting deployed to the target machine.

The problem, however, is that my props.conf settings are now not being respected.

Do I need to be putting the config files in a different 'app'? Such as the 'search' app opr the SplunkUniversalForwarder app? Or are there rules that dictate in which order the configuration files of each of the managed 'apps' are processed?

[root@cove-cdn apps]$ pwd

[root@cove-cdn apps]$ ls -l
total 16
drwx------ 4 root root 4096 Oct 19 09:19 forwarder
drwxr-xr-x 5 root root 4096 Oct 17 10:40 learned
drwxr-xr-x 6 root root 4096 Oct 17 10:40 search
drwxr-xr-x 4 root root 4096 Apr 15  2011 SplunkUniversalForwarder

Any guidance would be greatly appreciated.

0 Karma

Splunk Employee
Splunk Employee
0 Karma

Path Finder

That's not the question. THe problem is that the sourcetype is not getting set now that the props.conf is being menaged in the deployment by the deployment server instead of being configured manually on the forwarder box.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...