topic Re: props and transforms not working in Getting Data In

props and transforms not working

blbr123 — Wed, 01 Apr 2026 16:35:35 GMT

Hi All,

My props and transforms is not working.

Kept the props and transforms in the Heavy Forwarder.

can anyone please assist.

I want to drop the below lines from ingesting into Splunk but its not working.

#Date: 2024-05-03 00:00:01

#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken https

props:

[mysourcetype]
TRANSFORMS-drop_header= drop_header

Transforms:

[drop_header]

REGEX = ^#Date.+\n#Fields.+
DEST_KEY = queue
FORMAT = nullQueue

Re: props and transforms not working

gcusello — Thu, 09 May 2024 05:59:32 GMT

Hi @blbr123,

did you checked the regex in Splunk?

If you could share some sample of your logs I can help you in this.

are there other (one or more) HFs before the one where you located props and transforms?

The transofrmation muste be applied in the first full Splunk instance where data pass through.

Ciao.

Giuseppe

Re: props and transforms not working

blbr123 — Thu, 09 May 2024 06:03:03 GMT

Yes I have checked in regex looks good.

There are no other HF's before.

Re: props and transforms not working

gcusello — Thu, 09 May 2024 06:06:02 GMT

Hi @blbr123,

this seems to be a multiline og, try adding (?ms) at the beginning of the regex.

Then test your regex in Splunk not outside Splunk.

Ciao.

Giuseppe

Re: props and transforms not working

blbr123 — Thu, 09 May 2024 06:08:07 GMT

sure will give a try and what does (?ms) do?

Re: props and transforms not working

gcusello — Thu, 09 May 2024 06:15:18 GMT

Hi @blbr123 ,

(?ms) in a regex means that you have to consider a multiine event.

Ciao.

Giuseppe

Re: props and transforms not working

blbr123 — Thu, 09 May 2024 06:44:02 GMT

Tested in splunk , only when I add (?ms) in front of regex it matches.

But when I check this entire regex in the regex tool it does not match

(?ms)^#Date.+\n#Fields.+

and I am not sure if we add (?ms) in transforms will work or not?

Re: props and transforms not working

gcusello — Thu, 09 May 2024 06:55:01 GMT

Hi @blbr123 ,

test it in Splunk using the regex command.

Ciao.

Giuseppe

Re: props and transforms not working

PickleRick — Thu, 09 May 2024 07:55:49 GMT

This format looks suspiciously familiar. Check if you're using INDEXED_EXTRACTIONS on this sourcetype. If you do, the data is parsed on the UF and is not further processed on the indexer (or HF).