Getting Data In

How do i clone one sourcetype multiple times?

robertlynch2020
Motivator

HI

Currently i copy a sourcetypes with TRANSFORMS-CLONE and it works, example below.
But i want to use TRANSFORMS-CLONE multiple times from the original props.conf is that possible?

Current Situation

Forwarder
[monitor:///net/hp737srv/hp737srv1/apps/TEST/JAVA_11_TEST_FILES/FULL_LOGS_NO2/logs.../*]
sourcetype = G1
crcSalt = <SOURCE>

props.conf
[G1]
TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA

transforms.conf
[CLONE_SOURCETYPE_JAVA]
CLONE_SOURCETYPE = sun_jvm
REGEX = .

However I now have to make more TRANSFORMS-CLONE work from more then 1 (This does not work)

props.conf
[G1]
TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA
TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA2
TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA3

Or if i tried the other way in the to clone in the transforms.conf multiple times (it does not work either)

And use multiple CLONE_SOURCETYPE_JAVA in the transforms.conf, it only pick one of them not the second one.

transforms.conf
[CLONE_SOURCETYPE_JAVA]
CLONE_SOURCETYPE = sun_jvm
REGEX = .

[CLONE_SOURCETYPE_JAVA]
CLONE_SOURCETYPE = GC11
REGEX = .

It does work if i push one to another and then again to another...but this creates a long string. JAVA->GC11->sun_jvm
I want it to come in a sourcetype X. Then copy X to A,B,C and not have a long string

Thanks in Advance for any help
Rob 🙂

Tags (1)
1 Solution

nickhills
Ultra Champion
 props.conf
 [G1]
 TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA_sun_jvm,CLONE_SOURCETYPE_JAVA_gc11

transforms.conf
 [CLONE_SOURCETYPE_JAVA_sun_jvm]
 CLONE_SOURCETYPE = sun_jvm
 REGEX = .

[CLONE_SOURCETYPE_JAVA_gc11]
 CLONE_SOURCETYPE = GC11
 REGEX = .

Although I'm not sure I understand why you want to do this?

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion
 props.conf
 [G1]
 TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA_sun_jvm,CLONE_SOURCETYPE_JAVA_gc11

transforms.conf
 [CLONE_SOURCETYPE_JAVA_sun_jvm]
 CLONE_SOURCETYPE = sun_jvm
 REGEX = .

[CLONE_SOURCETYPE_JAVA_gc11]
 CLONE_SOURCETYPE = GC11
 REGEX = .

Although I'm not sure I understand why you want to do this?

If my comment helps, please give it a thumbs up!
0 Karma

robertlynch2020
Motivator

perfect, can you change to a an answer and i will accept it please.

0 Karma

robertlynch2020
Motivator

I need this as the files that come in *.gc.log can be many different garabage collection ways, JAVA 8,9,11 J1 etc.... So i have to take them in and use REGEX to decide what is what.

thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...