Getting Data In

I am unable to remove the standard Blue Coat heades tha begin with the # comment. I have tried several iterations of the nullQueue using REGEX and SEDCMD

babcolee
Path Finder

This is a copy of the log header and how I currently have the props.conf and transforms.conf configured

Software: SGOS 6.5.9.8

Version: 1.0

Start-Date: 2016-11-10 08:19:24

Date: 2016-08-12 01:46:28

Fields: date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-bluecoat-application-name x-bluecoat-application-operation x-bluecoat-transaction-uuid x-icap-reqmod-header(X-ICAP-Metadata) x-icap-respmod-header(X-ICAP-Metadata)

Remark: 4111140007 "fdc-bcoat-2" "140.108.3.12" "GSOCLogFeed"

props.conf
[bluecoat:proxysg:access:syslog]
TRANSFORMS-null = TrashHeader

transforms.conf
[TrashHeader]
REGEX = ^#
DEST_KEY = queue
FORMAT = nullQueue

Tags (2)
0 Karma

Azeemering
Builder

Late answer but maybe it will benefit someone who searches for the same in the future:
You have ^# that will discard all events that start with #
Your props and transforms look fine.

I think the main question is when do you want to discard them? At index time you need to make sure you place them on the indexers (or in etc/system/local on single install of splunk). Also make sure you restart splunk to make the settings active.

Whatever you do make sure you troubleshoot if the props and transform settings are active.
Use btool:

$SPLUNK_HOME/bin/splunk cmd btool props list

0 Karma

babcolee
Path Finder

Thank you for your response. Unfortunately, the Blue Coat header is still showing with the events

0 Karma

gokadroid
Motivator

Can you try to replace your regex of REGEX=^# to REGEX=^#.*$ and see if it works. See here for sample.

0 Karma

babcolee
Path Finder

Thank you for your response. Unfortunately, the Blue Coat header is still showing with the events

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...