Getting Data In

proper way to apply props.conf rules on a modified sourcetype, and other fun stories

yannK
Splunk Employee
Splunk Employee

I tried to setup 2 rules :
- one to rename the sourcetype A to B for some events
- one to apply a SEDCMD rule to the sourcetype B only.

But ultimately the SEDCMD never applied, it works only if I apply i to the sourcetype A.

[A] 
TRANSFORMS-set_sourcetype_to_ssl_audit = force_sourcetype_to_B 

[B] 
SEDCMD-anonymize = s/SSN(\d+)/SSNxxx/g 

transforms.conf

[force_sourcetype_to_B] 
REGEX = BFTW
DEST_KEY = MetaData:Sourcetype 
FORMAT = sourcetype::B 

Is it linked to the order of the rules ?

Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

As per @sowing comment.

The problem is that the 2 rules are for index time.
The first transform will apply renaming the sourcetype A to B.
But the event will not be parsed a second time (at index time) for the new sourcetype rules. Therefore the SEDCMD will never happen.

Remark: at search time. the new sourcetype rules may stilll apply ( by example a field extraction)

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

As per @sowing comment.

The problem is that the 2 rules are for index time.
The first transform will apply renaming the sourcetype A to B.
But the event will not be parsed a second time (at index time) for the new sourcetype rules. Therefore the SEDCMD will never happen.

Remark: at search time. the new sourcetype rules may stilll apply ( by example a field extraction)

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Per this , both SEDCMD and transforms.conf happen during 'Typing' queue process and since data is coming for sourcetype A so configuration for A will take effect and configuration (index-time) for sourcetype B will never take place.

sowings
Splunk Employee
Splunk Employee

Make that an answer, and I'll vote it up. You get one pass at parsing rules, starting with the original sourcetype, top to bottom, left to right.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...