Splunk Search

Can we use same property names (say "[setnull]","[setparsing]") defining the event data filtering criteria , in two different apps (having different filtering criteria) residing on same server ?

jincy_18
Path Finder

I have two clustered environments consisting of 3 SH,3 Indexers and 1 HWF each running on Splunk 6.4.1.I need to filter out certain unwanted events coming from jms queues and send them to the nullQueue.

We have two applications running on same servers, having different criteria for filtering event data.

I added below code in HWF in props.conf for one of the apps:

 [my_sourcetype]
 TRANSFORMS-set= setnull,setparsing

and this in transforms.conf

 [setnull]
 REGEX = .
 DEST_KEY = queue
 FORMAT = nullQueue

 [setparsing]
 REGEX = (?<=mbody=.{51}TQ-123|mbody=.{51}TQ-145)
 DEST_KEY = queue
 FORMAT = indexQueue

Can I use the same names property name i.e., "setnull" , "setparsing" in transforms.conf of the other app and define a new regex there? Will doing so have any impact on filtering?

0 Karma
1 Solution

meenal901
Communicator

Hi jincy_18,

No, you should not use the same stanza name even if apps are different. Splunk will not throw any error but as you might already know, your stanza settings will get merged based on priority of Configuration File Precedence which might lead to incorrect filtering. Check this for details:

http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles

View solution in original post

0 Karma

meenal901
Communicator

Hi jincy_18,

No, you should not use the same stanza name even if apps are different. Splunk will not throw any error but as you might already know, your stanza settings will get merged based on priority of Configuration File Precedence which might lead to incorrect filtering. Check this for details:

http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles

0 Karma

jincy_18
Path Finder

Thank you meenal, I changed the names and it works perfectly fine.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...