Hi,
Given the below:
inputs.conf
[monitor://\\MyServer\MyFolder]
disabled = false
host = MyServer
index = MyIndex
sourcetype = MySourceType
ignoreOlderThan = 2d
recursive = false
whitelist = (MyLog1\d+-\d+\.txt)|(MyLog2\d+-\d+\.txt)
props.conf
[MySourceType]
TRANSFORMS-trash = badError, badError2
BREAK_ONLY_BEFORE_DATE = TRUE
SHOULD_LINEMERGE = TRUE
TIME_FORMAT = %m/%d/%Y %T
TRUNCATE = 0
MAX_DAYS_AGO = 2
sourcetype = MySourceType
[source::.../\\Myfolder\\MyLog2*.txt]
TRANSFORMS-removejunk = setnull , setparsing
[source::..../MyServer\\MyFolder\\MyLog2*.txt]
TRANSFORMS-removejunk = setnull , setparsing
[source::\\\\MyServer\MyFolder\MyLog2*.txt]
TRANSFORMS-removejunk = setnull , setparsing
I'm trying to have a transform just for one of the log files (MyLog2) in the white list. The file is a UNC path and I have tried the 3 naming entries and nothing works. I use setnull
and setparsing
elsewhere so I know they function properly.
Is there a way to do this by source?
I have a workaround by creating a separate stanza just for this file, but it would be less configuration to be able to use the white list and execute a transform by source name.
Thank you,
Chris
are you on a single full instance or in a distributed architecture with some forwarders ?
In the second case, your settings may not be deployed on the correct instance.
Single. No forwarders.
Thanks for trying to help.
Chris
I think that the problem is definitely in your source::
spec. And I believe that it should be
[source::\\\\MyServer\\MyFolder\\MyLog2*.txt]
You might want to review the props.conf Global Settings
I learn something new every time I read the props.conf documentation!
Thanks. I just tried :
[source::\\MyServer\MyFolder\MyLog2*.txt]
Still no go. Maybe I'm missing something in reading the props.conf docs...
Chris
Have you checked the file $SPLUNK_HOME/var/log/splunk/splunkd.log for any warnings or errors?
Also, just running $SPLUNK_HOME/bin/splunk btool check
might also turn up something.
I'm running low on ideas...