topic Re: filter data problem with windows path in Getting Data In

filter data problem with windows path

my_splunk — Thu, 19 Apr 2012 15:08:33 GMT

I have installed splunk on windows 2008 to analyze iis log file.
I want to avoid to index log entries with 401 http status code, so i have used props.conf and transforms.conf files.

In props.conf i have:

[source::C:\\Users\\Administrator\\Desktop\\MyLogFolder\\mylogfile.log]

TRANSFORMS-nullcode= setnullcode

In transforms.conf file i have

[setnullcode]

REGEX = 401( [0-9]+){5}

DEST_KEY = queue

FORMAT = nullQueue

However i index log entries with 401 status code.
I have verified reg ex and it is all right, infact if i use in props.conf file

[host::myhost]

TRANSFORMS-nullcode= setnullcode

entries with 401 are correctly discarded.
Problem is with windows path....

Re: filter data problem with windows path

araitz — Thu, 19 Apr 2012 16:01:13 GMT

Not sure, are there any errors or related messages in $SPLUNK_HOME/var/log/splunk/splunkd.log?

Re: filter data problem with windows path

my_splunk — Fri, 20 Apr 2012 15:34:07 GMT

I have solved

In my first answer i wanted to write:

[source::C:\\Users\\Administrator\\Desktop\\MyLogFolder\\mylogfile.log]

i.e with a double \ but for my typing error i wrote with a single \

So my problem is with double \ in path.

I have solved typing path with a single \, i.e

[source::C:\Users\Administrator\Desktop\MyLogFolder\mylogfile.log]

At this point i think there is a problem in http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf doc, whete it is recommended to escape any backslashes contained within the specified file path in windows.

Re: filter data problem with windows path

my_splunk — Fri, 20 Apr 2012 15:37:03 GMT

i don't understand.....in preview there are double \ and in published answer a single . However i hope it is clear my solution.