topic Re: How to Exclude header data in cisco log file ? in Getting Data In

How to Exclude header data in cisco log file ?

dfigurello — Sat, 12 Dec 2015 03:48:33 GMT

Hi splunkers,

I would like to remove headers from a Cisco file. I've tried transforms configurations, but I can't get it work.
I ran a search to troubleshoot: index=_internal sourcetype=splunkd ignoreComments , with the following results:

 -0200 ERROR regexExtractionProcessor - REGEX field must be specified
 tranform_name=ignoreComments

Please find below details of the configurations:

C:\Program Files\Splunk\etc\apps\search\local\inputs.conf

[monitor://c:\cisco\*]
sourcetype = cisco_teste
disabled = false
index = treinamento

C:\Program Files\Splunk\etc\apps\search\local\props.conf

[cisco_teste]
TRANSFORMS-noComments = ignoreComments

C:\Program Files\Splunk\etc\apps\search\local\tranforms.conf

[ignoreComments]
REGEX = ^#
DEST_KEY = queue
FORMAT = nullQueue

Let me know if you guys need anything else, I really appreciate the help.
Cheers,

Re: How to Exclude header data in cisco log file ?

woodcock — Sat, 12 Dec 2015 05:13:09 GMT

You have a spelling mismatch; you need to settle on either ignoreComment or ignoreComments (note the extra s in the latter). Once you make this the same, it should work fine.

Re: How to Exclude header data in cisco log file ?

s2_splunk — Sat, 12 Dec 2015 05:13:49 GMT

You specified "ignoreComment" in props.conf, but you configured "ignoreComments" as the transforms.conf.
Make sure spelling exactly matches.

Re: How to Exclude header data in cisco log file ?

s2_splunk — Sat, 12 Dec 2015 05:14:46 GMT

Overlap with woodcock....

Re: How to Exclude header data in cisco log file ?

dfigurello — Sat, 12 Dec 2015 11:37:54 GMT

Hi Woodcock,

I am sorry but i did make a mistake when I put here in answers, please disregard it.

Tks.

Re: How to Exclude header data in cisco log file ?

dfigurello — Sat, 12 Dec 2015 11:38:08 GMT

Hi ssievert,,

I am sorry but i did make a mistake when I put here in answers, please disregard it.

Tks.

Re: How to Exclude header data in cisco log file ?

s2_splunk — Tue, 15 Dec 2015 18:57:18 GMT

You may want to match the full line that starts with '#', i.e. do REGEX=^#.*
I cannot see anything else that is wrong with your configuration. And you are configuring these files on your indexer, correct?

Re: How to Exclude header data in cisco log file ?

woodcock — Tue, 29 Sep 2020 08:11:01 GMT

Did you restart the Splunk instances on the Indexers where you put props.conf and transforms.conf?
Double-check this list:

The sourcetype matches replace_sourcetype_with_containing_directory exactly (casing, punctuation, etc.).
The props.conf and transforms.conf configuration files are deployed to the Indexers or Heavy Forwarders (or Universal Forwarders in some cases, such as INDEXED_EXTRACTIONS = CSV).
The inputs.conf configuration file is deployed to the Forwarder.
You must restart/bounce all Splunk instances on the servers where you deploy these files.
There are no configuration errors during restart (watch the response text during startup on one server of each type).
You are verifying proper current function by looking at NEW data (post-deploy/post-bounce), not previously indexed data (which is immutable).