Need help filtering events from UF to Indexer - events starting with word "Row"

[hrca33]

I need to filter evevnts like below to be indexed. (Data coming from UF to Indexers [using indexer cluster])

_raw
Row 375: account_id[.....some text ........some other text
Row 374: account_id[.....some text ........some other text
Row 373: account_id[.....some text ........some other text

My prop.conf

[some sourcetype]
TRANSFORMS-removejunk = removerows

My transforms.conf

[removerows]
REGEX = ^Row\s+\d+\:
DEST_KEY = queue
FORMAT = nullQueue

It's not working. Can anyone help?

[MuS]

Could please provide more information like:

• How is it not working? Not working at all or not filtering on Row...?
• did you apply it on the IDX's (assuming there is no HWF in use)?
• did you restart the IDX?
• check splunk btool props list to see if it's applied correct
• check splunk btool transforms list to see if it's applied correct
• typo in the sourcetype in props.conf ?
• do you get new event for the sourcetype since it is only applied to new events?
• this list can be very, very long but you have something to check now 😉

cheers, MuS

[hrca33]

1) Not filtering on Row.
2) Applied it on IDX's.
3) Applied cluster bundle for the IDX's.
4) There is no typo in the props.conf
5) yes we got new events after apply this.

Thanks in advance.

[esix_splunk]

Where do you have this installed at? Since UF cannot do parsing, this needs to be installed either on a HF, in between your UF and Indexers, or on the Indexers and configured for the designated Sourcetype.

[somesoni2]

The configurations looks good to me. Make sure you're deploying to correct Splunk Instance (Indexers in your case as you mentioned it's coming from UF to Indexer Cluster). Make sure you put the props/transforms using Cluster Master and then pushed the cluster bundle to Indexers. For reference, here is how that's done.
http://docs.splunk.com/Documentation/Splunk/6.4.3/Indexer/Updatepeerconfigurations