Splunk Heavy Forwarder Transforms

ferdousfahim — Wed, 14 Aug 2024 16:58:40 GMT

Hi,

I have a Splunk Heavy Forwarder routing data to a Splunk Indexer. I also have a search head configured that performs distributed search on my indexer.

My Heavy forwarder has a forwarding license, so it does not index the data. However, I still want to use props.conf and transforms.conf on my forwarder. These configs are:

===============================================================

transforms.conf [extract_syslog_fields] DELIMS = "|" FIELDS = "datetime", "syslog_level", "syslog_source", "syslog_message" =============================================================== props.conf [router_syslog] TIME_FORMAT = %a %b %d %H:%M:%S %Y MAX_TIMESTAMP_LOOKAHEAD = 24 SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) TRUNCATE = 10000 TRANSFORMS-extracted_fields = extract_syslog_fields

So what I expected is that when I search the index on my search head, I would see the fields "datetime", "syslog_level", "syslog_source", "syslog_message" . However, this does not occur. On the otherhand, if I configure field extractions on the search-head, this works just fine and my syslog data is split up into those fields.

Am I misunderstanding how Transforms work ? Is the heavy forwarder incapable of splitting up my syslog into different fields based on a delimiter because it's not indexing the data ?

Any help or advice would be highly appreciated. Thank you so much!

Re: Splunk Heavy Forwarder Transforms

gcusello — Wed, 14 Aug 2024 14:33:38 GMT

Hi @ferdousfahim ,

I usually use this transformations at search time, but to apply them on Forwarders, you have to use INDEXED_EXTRACTIONS=CSV in props.conf, for more infos see at https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Extractfieldsfromfileswithstructureddata

Ciao.

Giuseppe

topic Re: Splunk Heavy Forwarder Transforms in Getting Data In

Splunk Heavy Forwarder Transforms

Re: Splunk Heavy Forwarder Transforms