Hello,
I'm trying to filter out all the lines with DEBUG inside them. I've the following props.conf and transforms.conf but still not working.
Did I make any mistake please? How can I debug this please? Thanks.
props.conf:
[ABCLogs]
TRUNCATE = 100000
SHOULD_LINEMERGE = true
# BREAK_ONLY_BEFORE_DATE = true
BREAK_ONLY_BEFORE = \d+\s\w\w\w\s\d\d\d\d\s\d\d:\d\d:\d\d\,\d\d\d\s
TRANSFORMS-ABCLogs = ABC_setparsing,ABC_setnull
transforms.conf:
[ABC_setnull]
REGEX = (.*)DEBUG(.*)
DEST_KEY = queue
FORMAT = nullQueue
[ABC_setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue
Cheers,
Jack
Hi olimouse,
a few things to pay attention here:
is your sourcetype really ABCLogs
? This must match exactly
Is your props.conf and transforms.conf on the Splunk server doing event parsing? See this wiki to learn more: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
The regex in [ABC_setnull]
could also just be REGEX = DEBUG
Did you restart your Splunk server after the changes?
Did you try to change the order in the props.conf
to something like this:
TRANSFORMS-ABCLogs = ABC_setnull, ABC_setparsing
cheers, MuS