I have installed splunk on windows 2008 to analyze iis log file.
I want to avoid to index log entries with 401 http status code, so i have used props.conf and transforms.conf files.
In props.conf i have:
[source::C:\\Users\\Administrator\\Desktop\\MyLogFolder\\mylogfile.log]
TRANSFORMS-nullcode= setnullcode
In transforms.conf file i have
[setnullcode]
REGEX = 401( [0-9]+){5}
DEST_KEY = queue
FORMAT = nullQueue
However i index log entries with 401 status code.
I have verified reg ex and it is all right, infact if i use in props.conf file
[host::myhost]
TRANSFORMS-nullcode= setnullcode
entries with 401 are correctly discarded.
Problem is with windows path....
I have solved
In my first answer i wanted to write:
[source::C:\\Users\\Administrator\\Desktop\\MyLogFolder\\mylogfile.log]
i.e with a double \ but for my typing error i wrote with a single \
So my problem is with double \ in path.
I have solved typing path with a single \, i.e
[source::C:\Users\Administrator\Desktop\MyLogFolder\mylogfile.log]
At this point i think there is a problem in http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf doc, whete it is recommended to escape any backslashes contained within the specified file path in windows.
i don't understand.....in preview there are double \ and in published answer a single . However i hope it is clear my solution.
Not sure, are there any errors or related messages in $SPLUNK_HOME/var/log/splunk/splunkd.log?