Parsing pipe delimiter with props.conf and transforms.conf not working

[mlovasco]

Hi - trying to parse 2 similar sourcetypes with props.conf and transforms.conf but they are not working.  Help would be appreciated! Thanks!

Example events:

sourcetype=avaya:epm:mpplogs

@2021-11-19 09:41:54,070|PAVB_03335|INFO|VB|650636|Session=aipor-mpp001lv-2021323144040-7|Got VoiceXML exception: noinput in 9b99c62c5d35f81d18e547137018bef9663c3bc7a33f60a3f25aa4d55d36e14f|aipor-mpp001lv####

sourcetype=avaya:epm:vpmslogs

@2021-11-19 09:51:10,411 EST||FINE|AppIntfService|VoicePortal|ajp-nio-127.0.0.1-3009-exec-41|Method=PackageInfo::GetBuildVersion()| attempt to locate file on classpath. File = VPAppIntfService.aar|||||||aipva-epm001lv|4000064385####

props.conf

[avaya:epm:mpplogs]
REPORT-pipe-separated-fields-mpp = pipe-separated-fields-mpp

[avaya:epm:vpmslogs]
REPORT-pipe-separated-fields-vpms = pipe-separated-fields-vpms

transforms.conf

[pipe-separated-fields-mpp]
DELIMS = "|"
FIELDS = "eventTimestamp","eventName","eventLevel","triggerComponent","eventId","eventText","eventDescription","serverName"

[pipe-separated-fields-vpms]
DELIMS = "|"
FIELDS = "eventTimestamp","eventName","eventLevel","triggerComponent","eventMonitor","eventDescription"

(I've tried with and without quotes)

[mlovasco]

Yes, testing with verbose mode... none of my fields are appearing.

Should also mention that I'm Cloud, but my app is on a deployment server and being successfully deployed to appropriate clients.

[richgalloway]

How are you testing this?  Are you using Verbose mode?

[mlovasco]

Yes, testing with verbose mode... none of my fields are appearing.

Should also mention that I'm Cloud, but my app is on a deployment server and being successfully deployed to appropriate clients.

[PickleRick]

Wait a second. To which clients are you deploying this app?

[mlovasco]

Hosts where these logs are located... 

[richgalloway · Accepted solution]

There's the problem.  Parsing with these settings happens at search time so the settings need to be on the search heads.

[mlovasco]

Got it... will reroute my thinking.. thanks!

[richgalloway]

Check out https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F and https://www.aplura.com/assets/pdf/where_to_put_props.pdf