I have tried
props.conf
[hfss_source]
TRANSFORMS-set= set_parsing,set_null
transforms.conf
[set_null]
REGEX = standby
DEST_KEY = queue
FORMAT = nullQueue
[set_parsing]
REGEX =.
DEST_KEY=queue
FORMAT=indexQueue
Trying to get rid of all entries with the word "standby" in it, but everything gets indexed.
splunk cmd btool props list hfss_source
shows correctly, but
splunk cmd btool transforms list hfss_source
shows absolutely nothing
Any ideas ? I am completely lost, I feel I have done what everybody is writing will work, but I just can't get it to work?
Any help would be greatly appriciated
... View more