topic Re: btool command returns many duplicate events for props.conf in Getting Data In

Why is btool command returning many duplicate events for props.conf?

asimagu — Mon, 05 Jun 2023 14:12:28 GMT

hi guys

I am experiencing an odd behavior when using btool to troubleshoot some issues.

When I run btool to get the list of props.conf in my instance I get lots of duplicates and I don´t know why this is happening nor if it is normal / expected to be like this. any ideas or explanations??

Example:

$ splunk btool props --debug list | grep send_to_nullqueue

/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
/opt/splunk/etc/apps/test/default/props.conf TRANSFORMS = send_to_nullqueue
....
....
...
(lots of times)

Here is the content of my props.conf and my transforms.conf

props.conf

[default]
TRANSFORMS = send_to_nullqueue

transforms.conf

[send_to_nullqueue_slb]
DEST_KEY = queue
REGEX = blah\sblah\sblah
FORMAT = nullQueue

Re: btool command returns many duplicate events for props.conf

gcusello — Tue, 19 Sep 2017 09:47:12 GMT

Hi
this means that in the props.con of the app test you have many stanzas where you want to execute the TRANSFORMS = send_to_null_queue command.
If you see only these rows you cannot understand the contest of the command!

The best way to proceed is to run the command readdressing output in a text file

splunk btool props --debug list > file.txt

in this way you have all the command results in a file and you can examine it.

Bye.
Giuseppe

Re: btool command returns many duplicate events for props.conf

gcusello — Wed, 20 Sep 2017 11:13:39 GMT

If this answer satisfies your question, please accept or upvote it.
Bye.
Giuseppe

Re: btool command returns many duplicate events for props.conf

asimagu — Wed, 20 Sep 2017 12:04:16 GMT

it does not. thanks but I understand the command very well enough.
I only have one stanza in that execute that Transforms.
We have been working with Splunk Support for some time but could not find an explanation yet, that´s why I brought it to the community. I would appreciate a little bit of respect when you provide an answer. thanks again

Re: btool command returns many duplicate events for props.conf

asimagu — Wed, 20 Sep 2017 12:15:29 GMT

I downvoted this post because it is offensive and does not answer the question

Re: btool command returns many duplicate events for props.conf

abalogh_splunk — Tue, 29 Sep 2020 15:49:22 GMT

Hello,

The reason you are seeing that many send_to_nullqueue is because you have added it to [default] stanza which means it will be applied to ALL sourcetypes. To avoid this do not use [default] and instead add the proper stanza.

I hope this helps you to understand.

br
Adam

*edit spelling

Re: btool command returns many duplicate events for props.conf

asimagu — Thu, 21 Sep 2017 12:58:40 GMT

Thanks Adam. This makes sense now. However this is only a part of the case we have with Splunk Support. If you have time, feel free to take a look at #540217

Re: btool command returns many duplicate events for props.conf

fredclown — Fri, 02 Jun 2023 15:40:52 GMT

@gcusello's answer is not disrespectful in anyway. Nothing that he said was demeaning or implied malice. I have received much help from @gcusello in the past and his answers have always been respectful. I think you are reading into something that is not there.