I need to filter evevnts like below to be indexed. (Data coming from UF to Indexers [using indexer cluster])
_raw
Row 375: account_id[.....some text ........some other text
Row 374: account_id[.....some text ........some other text
Row 373: account_id[.....some text ........some other text
My prop.conf
[some sourcetype]
TRANSFORMS-removejunk = removerows
My transforms.conf
[removerows]
REGEX = ^Row\s+\d+\:
DEST_KEY = queue
FORMAT = nullQueue
It's not working. Can anyone help?
Could please provide more information like:
Row...
?splunk btool props list
to see if it's applied correctsplunk btool transforms list
to see if it's applied correct props.conf
?cheers, MuS
1) Not filtering on Row.
2) Applied it on IDX's.
3) Applied cluster bundle for the IDX's.
4) There is no typo in the props.conf
5) yes we got new events after apply this.
Thanks in advance.
Where do you have this installed at? Since UF cannot do parsing, this needs to be installed either on a HF, in between your UF and Indexers, or on the Indexers and configured for the designated Sourcetype.
The configurations looks good to me. Make sure you're deploying to correct Splunk Instance (Indexers in your case as you mentioned it's coming from UF to Indexer Cluster). Make sure you put the props/transforms using Cluster Master and then pushed the cluster bundle to Indexers. For reference, here is how that's done.
http://docs.splunk.com/Documentation/Splunk/6.4.3/Indexer/Updatepeerconfigurations