Rule-based association of source types

Rule-based association of source types

Create rules to automatically assign source types in Splunk. Use props.conf to set source typing rules. Edit props.conf in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information on configuration files in general, see how configuration files work.

Configuration

Create a rule by adding a rule:: or delayedrule:: stanza to props.conf. Under the rule stanza, declare the name of the source type. After the source type declaration, list the rules to assign the source type. Rules are created based on a series of MORE_THAN, and LESS_THAN statements that must be matched. The statements are regular expressions that must be matched by the specified percentage of lines that match the regular expression. Any number of statements can be specified, and all statements must match in order for the source to fit the source type rule.

Add the following to $SPLUNK_HOME/etc/system/local/props.conf:

[rule::$RULE_NAME] OR [delayedrule::$RULE_NAME]
sourcetype=$SOURCETYPE
MORE_THAN = $REGEX
LESS_THAN = $REGEX

Note: A rule can have many MORE_THAN and LESS_THAN patterns. All must be met in order for the rule to match.

Rules are created based on the percentage of the number of lines that contain the specified string. To match, a rule can be either MORE_THAN or LESS_THAN that percentage.

Examples

The following examples come from $SPLUNK_HOME/etc/system/default.

postfix syslog files

# postfix_syslog sourcetype rule
[rule::postfix_syslog]
sourcetype = postfix_syslog
# If 80% of lines match this regex, then it must be this type
MORE_THAN_80=^\w{3} +\d+ \d\d:\d\d:\d\d .* postfix(/\w+)?\[\d+\]:

delayed rule for breakable text

# breaks text on ascii art and blanklines if more than 10% of lines have
# ascii art or blanklines, and less than 10% have timestamps
[delayedrule::breakable_text]
sourcetype = breakable_text
MORE_THAN_10 = (^(?:---|===|\*\*\*|___|=+=))|^\s*$
LESSS_THAN_10 = [: ][012]?[0-9]:[0-5][0-9]

• Was this topic useful?
• Post a comment