https://community.splunk.com/t5/Getting-Data-In/Debugging-LINE-BREAKER-and-TRANSFORMS/m-p/36838#M6786 <P>Are there any DEBUG settings I can enable to get more information on how LINE_BREAKER and TRANSFORMS settings are applied at index-time?</P> Wed, 02 Feb 2011 02:12:26 GMT mzorzi 2011-02-02T02:12:26Z https://community.splunk.com/t5/Getting-Data-In/Debugging-LINE-BREAKER-and-TRANSFORMS/m-p/36838#M6786 <P>Are there any DEBUG settings I can enable to get more information on how LINE_BREAKER and TRANSFORMS settings are applied at index-time?</P> Wed, 02 Feb 2011 02:12:26 GMT https://community.splunk.com/t5/Getting-Data-In/Debugging-LINE-BREAKER-and-TRANSFORMS/m-p/36838#M6786 mzorzi 2011-02-02T02:12:26Z https://community.splunk.com/t5/Getting-Data-In/Debugging-LINE-BREAKER-and-TRANSFORMS/m-p/36839#M6787 <P>The <CODE>category.regexExtractionProcessor</CODE> log category should produce errors for some categories of failing to compile the TRANSFORMS regexes. You could turn up its verbosity to get success messages when building them as well. They do not have debug output after the first matching event comes through.</P> <P>I've generally found it necessary to use a combination of <CODE>pcretest</CODE>, test instances/indexes, bogus fields, and careful tests to determine the cause of TRANSFORMS troubles.</P> <P>Line breaking similarly will produce output saying what conf is loaded for <CODE>category.LineBreakingProcessor</CODE>, ie for a given conf/source/sourcetype, it will say what the truncation length is as well as the lookbehind (if these are set).</P> Wed, 02 Feb 2011 04:21:58 GMT https://community.splunk.com/t5/Getting-Data-In/Debugging-LINE-BREAKER-and-TRANSFORMS/m-p/36839#M6787 jrodman 2011-02-02T04:21:58Z