https://community.splunk.com/t5/Getting-Data-In/Props-and-Transforms-doubt/m-p/704143#M116460 <P class="lia-align-justify">I am pretty new to Splunk and my project is also new. Can someone please explain the configurations given in our cluster manager. We have a syslog server which receives logs from F5 WAF devices and UF in syslog server forwards the data to our cluster manager.</P> Sat, 16 Nov 2024 13:19:48 GMT splunklearner 2024-11-16T13:19:48Z https://community.splunk.com/t5/Getting-Data-In/Props-and-Transforms-doubt/m-p/704143#M116460 <P class="lia-align-justify">I am pretty new to Splunk and my project is also new. Can someone please explain the configurations given in our cluster manager. We have a syslog server which receives logs from F5 WAF devices and UF in syslog server forwards the data to our cluster manager.</P> Sat, 16 Nov 2024 13:19:48 GMT https://community.splunk.com/t5/Getting-Data-In/Props-and-Transforms-doubt/m-p/704143#M116460 splunklearner 2024-11-16T13:19:48Z https://community.splunk.com/t5/Getting-Data-In/Props-and-Transforms-doubt/m-p/704395#M116480 <P>Check out following helpful docs and specifications files <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkdoeswithyourdata" target="_blank">How Splunk Enterprise handles your data - Splunk Documentation</A></P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/Propsconf" target="_blank">props.conf - Splunk Documentation</A></P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/Transformsconf" target="_blank">transforms.conf - Splunk Documentation</A></P> Thu, 14 Nov 2024 08:05:25 GMT https://community.splunk.com/t5/Getting-Data-In/Props-and-Transforms-doubt/m-p/704395#M116480 PaulPanther 2024-11-14T08:05:25Z https://community.splunk.com/t5/Getting-Data-In/Props-and-Transforms-doubt/m-p/704444#M116489 <P>Hi</P><P>Based on these conf files it seems to do next.</P><OL><LI>Take timestamp from beginning of event and put it into _time</LI><LI>Ensure that lines are not longer than 10000 characters&nbsp;</LI><LI>syslog-host transformation is missing, so I cannot tell what it do!</LI><LI>extract hostname from event and save it into metadata to use on next step</LI><LI>define used index based on hostname (fqdn) on event. Fqdn vs index is defined on that csv lookup file</LI><LI>Change \r\n newline to just \n&nbsp;</LI><LI>Don't generate punctuation for event</LI></OL><P>More detailed information from those links which&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/233419">@PaulPanther</a>&nbsp;add in his post.</P><P>r. Ismo</P> Thu, 14 Nov 2024 21:11:35 GMT https://community.splunk.com/t5/Getting-Data-In/Props-and-Transforms-doubt/m-p/704444#M116489 isoutamo 2024-11-14T21:11:35Z