topic Re: Updated props/transforms don't change the search result in Getting Data In

Updated props/transforms don't change the search result

viraptor — Thu, 02 Mar 2017 06:00:27 GMT

I've updated the props in on a 6.1 server. Checked with btool which claims my configs are acceptable.

I've also checked btool props and see the updated REPORT-access as well as EVAL-some_name.

I tried loading /debug/refresh which does show Refreshing admin/transforms-extract OK

But when loading a few lines from the logs, I don't see any fields which I added. Neither the ones from a new REPORT, nor the one from EVAL. Everything looks just like it did before.

What else am I missing? Is there something else I can try to debug?

Re: Updated props/transforms don't change the search result

DalJeanis — Thu, 02 Mar 2017 14:57:41 GMT

have you restarted splunk since changing the .confs??

Re: Updated props/transforms don't change the search result

lguinn2 — Thu, 02 Mar 2017 16:31:02 GMT

Are you certain that the data has the same sourcetype as you specified in props.conf and transforms.conf? Might you have a typo in one or more of these files? btool is great, but it only checks syntax. btool can't test the actual formatting or regular expressions since it only looks at the configuration files, not the data.

If these hints don't help, please post the relevant stanzas from props.conf and transforms.conf. A little sample data (properly anonymized of course) would also be useful to help the community answer your question.

Re: Updated props/transforms don't change the search result

viraptor — Thu, 02 Mar 2017 22:43:40 GMT

@DalJeanis no, according to the docs, the reload should be enough to do this.

Re: Updated props/transforms don't change the search result

viraptor — Thu, 02 Mar 2017 23:03:33 GMT

I've got a host which adds the processing time to the end of nginx log line. This looks like the following:

client_ip - - [03/Mar/2017:09:54:56 +1100] "GET /some/path HTTP/1.1" 200 233474 "https://some/referer" "useragent" "cookies" "0.662"

This normally gets parsed by access_combined_wcookie, but sticks "0.662" into "other" field. I want to create a req_duration, so I added apps/marketplace/default/props.conf:

[access_combined_wcookie]
[source::/var/log/marketplace/nginx-access.log]
REPORT-access = access-extractions-marketplace

and apps/marketplace/default/transforms.conf:

[access-extractions-marketplace]
# based on system access-extractions, but with extra req_duration at the end
REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?<referer>[[bc_domain:referer_]]?+[^"]*+)"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?\s++"[[float:req_duration]]"[[all:other]]

The search results are not changed however. All looks the same after reloads.