topic Re: Index time props and transforms not working in Getting Data In

Index time props and transforms not working

splunkIT — Tue, 14 Jan 2014 21:50:30 GMT

I have the following props & transforms in splunk dev and prod environment monitoring the same set of iis logs:

props.conf

[source::/var/www/logs/someiislog2*]
CHECK_FOR_HEADER=false
TZ = UTC
pulldown_type = true
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = false
EXTRACT-SiteID = (?W3SVC\d+) in source
REPORT-iisFields= iis-c
SEDCMD-001TrimWhiteSpace = s/(\s)\s+/\1/g
SEDCMD-002RemoveCookie = s/(.*\s\d{1,}\.\d{1,}\.\d{1,}\.\d{1,})\s\S+\s(\S+\s.*)/\1 - \2/g
TRANSFORMS-ToIisSourceType = forcetoIISsourcetype

transforms.conf

[iis-c]
DELIMS = " "
FIELDS = date, time, cs_method, cs_uri_stem, cs_uri_query, c_ip, cs_Cookie, cs_Referer, cs_host, sc_status, sc_bytes, time_taken

[forcetoIISsourcetype]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::iis

Everything works in dev, but in prod, none of the index-time stuff (SEDCMD and TRANSFORMS-ToIisSourceType ) appears to be working. I have checked the splunkd.log but did not find any relevant message.

How can I further troubleshoot this issue? Which debug parameters can I enable to gather more information?

Re: Index time props and transforms not working

linu1988 — Wed, 22 Jan 2014 18:38:00 GMT

Obvious, but are they placed in indexers?

Re: Index time props and transforms not working

landen99 — Wed, 05 Aug 2015 22:28:14 GMT

Is there a UF in here and which Splunk clients have your props settings?

Re: Index time props and transforms not working

woodcock — Thu, 06 Aug 2015 02:39:40 GMT

If it works in Dev then the only thing that could be wrong is that you have not put the files in the right place on your Indexers or that you have not restarted the Splunk instances on your Indexers. You did restart Splunk on your Indexers, right?