topic Re: Try to use transforms.conf in Getting Data In

Try to use transforms.conf

Hula — Tue, 29 Sep 2020 12:24:24 GMT

Hi,

we try around with Splunk (first contact). We to prof what we can log from HDS Storages.

System report via Port 11101 UDP:

As an example what we dont need.
"Jan 18 11:44:23 SYSXX Jan 18 11:44:27 SVP Storage: CELFSS,1.1,410713,,2017-01-18T11:44:27.1+01:00,Storage,SVP,Authentication,Success,uid=lalalal({COMPONENT-POLLER}:DvM_Srv),R800:XXXXX,,SYSXX_Auditlog,,,,from=10.135.XXX.XXX,,,,384397,BasicLog,,,RMI AP,167,,[BASE],Logout,,Normal end,Seq.=0000384397"

these messages are coming (varies) in 1-5 minutes with similia content. All what we get with "POLLER" shoudl be not sorted in...ist useless for us.

Copy props.conf to *system/local and add at the end:
[source::udp:11101]
TRANSFORMS-null= setnull

copy transforms and add at the end.
[setnull]
REGEX = [/POLLER]
DEST_KEY = queue
FORMAT = nullQueue

But that did not work. All of the messages are coming in. I guess i made a failure in REGEX or in Brain 1.0...not sure.
where is my fault?

regards

Re: Try to use transforms.conf

Richfez — Wed, 18 Jan 2017 12:49:59 GMT

Hula, you made me laugh this morning. "... a failure in REGEX or in Brain 1.0". Thank you for that.

BTW, try REGEX=POLLER

I'm assuming that the word "POLLER" won't be found in any event you want to keep? Here's the regex101 you can use to confirm it works.

https://regex101.com/r/Dtydhe/1

Re: Try to use transforms.conf

Hula — Wed, 18 Jan 2017 13:00:34 GMT

Will try this line.
REGEX = POLLER

Thx...have to wait i little while.

Re: Try to use transforms.conf

Hula — Wed, 18 Jan 2017 13:22:00 GMT

Hmmm, did not work. Sry, im realy a beginner.

[setnull]
REGEX = POLLER
DEST_KEY = queue
FORMAT = nullQueue