Getting Data In

Problem routing events to nullQueue

nocostk
Communicator

I'm trying to get a multi-line log4j event sent to the nullQueue on a Regular forwarder. Here is my inputs/props/transforms.conf:

[monitor:///opt/ShoppingSite/work/logs/tomcat.log]
disabled = false
followTail = 1
sourcetype = log4j

[source::///opt/ShoppingSite/work/logs/tomcat.log]
TRANSFORMS-filtercrap = cleantomcat

[cleantomcat]
REGEX = (?m).+getResponseEntity\nINFO:\s+The\slength\sof\sthe\smessage\sbody\sis\sunknown.+
DEST_KEY = queue
FORMAT = nullQueue

This is the event from my tomcat log I need filtered:

Nov 24, 2010 12:51:18 PM com.noelios.restlet.http.HttpClientCall getResponseEntity
INFO: The length of the message body is unknown. The entity must be handled carefully and consumed entirely in order to surely release the connection.

I've checked my regex using KiKi (Linux regex utility). Anyone have any thoughts? These events are still showing up when I search on my search head.

Tags (2)
0 Karma
1 Solution

bfaber
Communicator

What happens if you change the props.conf from

[source::///opt/ShoppingSite/work/logs/tomcat.log]

to

[log4j]

and restart the forwarder?

View solution in original post

0 Karma

bfaber
Communicator

What happens if you change the props.conf from

[source::///opt/ShoppingSite/work/logs/tomcat.log]

to

[log4j]

and restart the forwarder?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

source:: clauses should not have the triple slashes /// at the start, just the /. The // is part of inputs monitor syntax.

0 Karma

nocostk
Communicator

That seems to work. Why would sourcetype work but not source?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...