Splunk Search

How to configure regex for transforms.conf and props.conf to send specified IIS data to nullQueue?

cdupuis123
Path Finder

Trying to dump off what seems like a simple thing to do from raw iis logs.

just want to not allow this to index: cs_uri_stem = /CLBOnline/AppOnline

my props.conf is
[iis]
TRANSFORMS-set = setnull1

my transforms.conf is

bit bucket for IIS

[setnull1]
REGEX=\/CLBOnline\/AppOnline

DEST_KEY = queue
FORMAT = nullQueue

I'm running Splunk 6.1

Tags (3)
1 Solution

cdupuis123
Path Finder

Update apparently in Splunk v6 we can now transform IIS, & csv logs on the Universal Forwarder! News to me. Next hurtle (for me) was getting it to work on the UF, as it would work fine in the etc\system\local (not possible I think from a deployment server) but wouldn't work in the app directory. My SE pointed out the fact that I needed to basically declare in the app metadata directory add to the default.meta:
[props]
export = system
[transforms]
export = system

I've learned something new, and hope others figured this out faster than I!!!! Regardless it's documented now.

Thanks Jeff

View solution in original post

cdupuis123
Path Finder

Update apparently in Splunk v6 we can now transform IIS, & csv logs on the Universal Forwarder! News to me. Next hurtle (for me) was getting it to work on the UF, as it would work fine in the etc\system\local (not possible I think from a deployment server) but wouldn't work in the app directory. My SE pointed out the fact that I needed to basically declare in the app metadata directory add to the default.meta:
[props]
export = system
[transforms]
export = system

I've learned something new, and hope others figured this out faster than I!!!! Regardless it's documented now.

Thanks Jeff

Richfez
SplunkTrust
SplunkTrust

Can you confirm that your sourcetype is correctly set to iis? I had this problem and found it was being set to iis-2.

0 Karma

cdupuis123
Path Finder

ya I figured that out martin, thanks regex is still stumping me....

0 Karma

cdupuis123
Path Finder

Maybe that's my issue, I'm pumping these IIS logs into an iis index, when I search index=iis the sourcetype of iis comes back, but when I search sourcetype=iis I get nothing?????

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That's likely due to the iis index not being listed in your user's role's "indexes searched by default", so when not specifying an index in the search it probably just looks in the main index.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...