topic Re: Transform to replace index does not work for two hosts in Getting Data In

Transform to replace index does not work for two hosts

echalex — Thu, 14 Sep 2017 10:00:01 GMT

Due to certain reasons, we have a number of destination indexes that need to be rewritten before indexing. Basically a partner of ours is using the name fubar_company, while we use another. We have a number of rules in transforms.conf to rewrite. The failing example is below. The others are very similar.

This works for the entire infrastructure, except two Splunk servers, one search head and one cluster master. Both of them forward to the indexer cluster, with indexAndForward = false.

For a while, we received alerts for events being forwarded to a non-existing index. So I created the index and can see the events in index=os from both hosts. The splunk_server field reveals that the events end up in the correct indexers, but not index.

We're using Splunk 6.2.1. The files are distributed to the indexers through the cluster master.

props.conf:
[default]
TRANSFORMS-changeindex=redirIdxLinux # There are more transforms here, but this is the failing one

transforms.conf:
[redirIdxLinux]
REGEX = linux_company
SOURCE_KEY = _MetaData:Index
DEST_KEY = _MetaData:Index
FORMAT = os

Re: Transform to replace index does not work for two hosts

maciep — Thu, 14 Sep 2017 15:28:15 GMT

do you have those setting pushed to your search head and cm as well? I believe that parsing will happen at the first full Splunk Enterprise instance along the way, which would be the servers themselves.

Re: Transform to replace index does not work for two hosts

echalex — Mon, 18 Sep 2017 12:02:22 GMT

Yep, you're quite right. Actually, the thought occurred to me, so I copied the files to the relevant servers and did an |extract reload=T as per the documentation. However, it seems this doesn't take effect without a full restart. It works as expected after a restart.
Thanks!

Re: Transform to replace index does not work for two hosts

jluo_splunk — Mon, 18 Sep 2017 14:44:34 GMT

I believe the "|extract reload=T" was deprecated. Do you have admin capabilities on your splunk servers? You can go to :/debug/refresh to reload the transforms and props without a full restart.