topic Re: Why is my SEDCMD props.conf file not working? in Getting Data In

Why is my SEDCMD props.conf file not working?

cbou — Fri, 31 Oct 2014 14:30:11 GMT

I have created a props.conf file under etc/system/local/props.conf

The content is

[default]
SEDCMD-ipi2 = y/e/g/g

I would expect that any letter e would be replaced with a g but it's not working.

Should I activate in any way this file or something like that?

Re: Why is my SEDCMD props.conf file not working?

martin_mueller — Fri, 31 Oct 2014 14:55:28 GMT

If you just dropped the file there then you need to restart Splunk since that's an index-time setting.

Once you've done that you can use this call to confirm Splunk reading that file:

./bin/splunk cmd btool --debug props list

Re: Why is my SEDCMD props.conf file not working?

cbou — Fri, 31 Oct 2014 15:28:28 GMT

I always restarted before. With your debug option I even can read /opt/splunkforwarder/etc/system/local/props.conf SEDCMD-ipi2 = y/e/g/g. It seams that it does not appear as much as the other lines. But the letter e still appears on the splunk server.

Re: Why is my SEDCMD props.conf file not working?

somesoni2 — Fri, 31 Oct 2014 16:53:26 GMT

Use this

[default]
SEDCMD-ipi2 = s/e/g/g

option "y" is for strings and does't do global replacement.

Re: Why is my SEDCMD props.conf file not working?

martin_mueller — Fri, 31 Oct 2014 17:11:56 GMT

The way I understand it, y/e/g/ shouldn't need the g flag because character substitution only makes sense globally... do try leaving off the global flag.

Re: Why is my SEDCMD props.conf file not working?

cbou — Fri, 31 Oct 2014 19:03:17 GMT

Even this does not work.

Re: Why is my SEDCMD props.conf file not working?

cbou — Fri, 31 Oct 2014 19:03:37 GMT

Even with y/e/g the props.conf does not work...

Re: Why is my SEDCMD props.conf file not working?

martin_mueller — Fri, 31 Oct 2014 19:43:10 GMT

You are looking at stuff indexed after setting this, right?

Re: Why is my SEDCMD props.conf file not working?

cbou — Fri, 31 Oct 2014 20:51:51 GMT

Yes, i'm refreshing the page, which produce a log with the date, so I'm sure.

Re: Why is my SEDCMD props.conf file not working?

martin_mueller — Fri, 31 Oct 2014 21:03:07 GMT

Well, something's fishy in your Splunk environment... I've just created a props.conf in system/local like this:

[default]
SEDCMD-ipi2 = y/e/g/

and now get events like this:

127.0.0.1 - admin [31/Oct/2014:22:02:08.023 +0100] "GET /sgrvicgsNS/admin/sgarch/sgarch/typgahgad?prgfix=indgx%3D_intgrnal&count=50&max_timg=1&output_modg=json HTTP/1.0" 200 73 - - - 2ms

Looks fing to mg.

Re: Why is my SEDCMD props.conf file not working?

cbou — Fri, 31 Oct 2014 21:12:10 GMT

I even try with another server, it does not work... Our forwarder has the version 5.0.4.

Re: Why is my SEDCMD props.conf file not working?

cbou — Fri, 31 Oct 2014 21:41:33 GMT

I found it! I was configuring the forwarder and not the server! Note with 6.1 props.conf might have to go on the UFs. From dev: With 6.1, the structured data props.conf are happening at monitoring time therefore the props.conf has also to be on the forwarders. makes me on the right way. Thanks for the help 🙂

Re: Why is my SEDCMD props.conf file not working?

martin_mueller — Fri, 31 Oct 2014 22:08:30 GMT

Yeah, this does belong on the indexer if you're sending it from a universal forwarder. Some newer settings also require some props.conf keys to be present on the forwarder, but stuff like SEDCMD doesn't - regardless of the version.

Re: Why is my SEDCMD props.conf file not working?

cbou — Fri, 31 Oct 2014 22:11:14 GMT

From my point of view it makes more sense to anonymize data from the Forwarder and not on the server. That's why I always tried to configure the forwarder.

Re: Why is my SEDCMD props.conf file not working?

martin_mueller — Fri, 31 Oct 2014 22:14:39 GMT

You can do that, just not on a universal forwarder. Replace it with a heavy forwarder that does all the parsing, timestamping, regexreplacement, yada yada on the source machine and you're there. Then you will need this props.conf setting on the heavy forwarder.

Re: Why is my SEDCMD props.conf file not working?

cbou — Fri, 31 Oct 2014 22:24:34 GMT

Ok now I understand what universal forwarder client means. Thanks 🙂

Re: Why is my SEDCMD props.conf file not working?

martin_mueller — Fri, 31 Oct 2014 22:33:02 GMT

For reference here's a quick comparison: http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Typesofforwarders#Forwarder_comparison

"Per-Event filtering" is what you're doing here, basically.

Re: Why is my SEDCMD props.conf file not working?

landen99 — Wed, 05 Aug 2015 22:26:12 GMT

Are you saying that props settings for structured data on the forwarder were interfering with props.conf settings on the indexer because the "monitoring time" for the inputs needs structured settings, but structured settings end the data parsing phase so that it cannot happen on the indexers?

Re: Why is my SEDCMD props.conf file not working?

nawazns5038 — Fri, 05 Apr 2019 01:35:26 GMT

I have added SEDCMD on heavy forwarder and it does not work. I have tested the settings individually using UI and it works.