topic Re: Why am I still seeing debug logs in the Splunk heavy forwarder filtering? in Getting Data In

Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

raindrop18 — Fri, 20 Apr 2018 17:32:01 GMT

I have set the following on transforms.conf and props.conf but I still see DEBUG logs in my search. what did I miss

transforms.conf

#Remove: DEBUG
[null_kube_DEBUG]
REGEX = (DEBUG)
DEST_KEY=queue
FORMAT=nullQueue

props.conf

#### kube ################################
[source::kube.var.log.containers.*]
TRANSFORMS-null = null_kube_DEBUG

Re: Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

richgalloway — Fri, 20 Apr 2018 18:08:36 GMT

Did you restart the HF?

Re: Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

raindrop18 — Fri, 20 Apr 2018 18:54:09 GMT

yes I did 🙂

Re: Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

somesoni2 — Fri, 20 Apr 2018 20:31:09 GMT

This will only affect the new incoming messages (any already ingested data would still showup in the search results). What does you DEBUG event look like? Can share a sample or two?

Re: Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

raindrop18 — Fri, 20 Apr 2018 20:38:38 GMT

2018-04-20 20:36:35 DEBUG NetworkClient:627 - Initiating connection to node -1 at myserver1.net:9092.\n
2018-04-20 20:36:35 DEBUG NetworkClient:767 - Initialize connection to node -1 for sending metadata request\n
2018-04-20 20:36:35 DEBUG NetworkClient:570 - Node -3 disconnected.\n
2018-04-20 20:36:35 DEBUG NetworkClient:627 - Initiating connection to node -1 at myserver1.net:9092.\n
2018-04-20 20:36:35 DEBUG NetworkClient:767 - Initialize connection to node -1 for sending metadata request\n
2018-04-20 20:36:35 DEBUG NetworkClient:570 - Node -2 disconnected.\n

Re: Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

raindrop18 — Fri, 20 Apr 2018 20:39:12 GMT

this is newly ingested data.

Re: Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

p_gurav — Mon, 23 Apr 2018 04:27:27 GMT

Can you try to use in props.conf:

 [null_kube_DEBUG]
 REGEX = DEBUG
 DEST_KEY=queue
 FORMAT=nullQueue

Re: Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

raindrop18 — Mon, 23 Apr 2018 14:57:03 GMT

thanks for the response, but still not filtering DEBUG. is there any difference for the logs ingested via http even collector (HEC)? this issue only I got on the logs ingested via HEC, other logs ingested via UF I don't see this issue.