topic Re: Transforms: why is nullQueue not working? in Getting Data In

Transforms: why is nullQueue not working?

amiftah — Fri, 07 Sep 2018 16:30:49 GMT

Hello,

I want to discard events that contain a string "Content", the following doesnt work, because I still see events with Content after I restarted and re-indexed:

transforms.conf
[allNullQueue]
REGEX = Content
DEST_KEY = queue
FORMAT = nullQueue

props.conf
[mysrctype]
TRANSFORMS-setnull = allNullQueue

I tried this in a standalone env, version 7.0.3 and 7.1.2
I can't find out where the problem is coming from.

Any clue?
Thanks

Re: Transforms: why is nullQueue not working?

horsefez — Fri, 07 Sep 2018 16:39:06 GMT

I think only @micahkemp can help here. :horse:

Re: Transforms: why is nullQueue not working?

sudosplunk — Fri, 07 Sep 2018 16:40:57 GMT

Hi, do you have the same TRANSFORMS-setnull class defined elsewhere apart from the props.conf in question? You can check this by running a btool on your props splunk btool props list --debug | grep 'TRANSFORMS'.

Re: Transforms: why is nullQueue not working?

marycordova — Fri, 07 Sep 2018 17:47:11 GMT

this is Splunk Enterprise and not a universal forwarder correct?

Re: Transforms: why is nullQueue not working?

marycordova — Fri, 07 Sep 2018 17:55:58 GMT

must be Splunk Enterprise (not Universal Forwarder)
props.conf should reference source not sourcetype
props.conf TRANSFORMS class and stanza name should be unique across deployment, not just specific config file

props.conf
[source::/mysource/example/*.csv]
TRANSFORMS-setnull = allNullQueue

transforms.conf
[allNullQueue]
REGEX = Content
DEST_KEY = queue
FORMAT = nullQueue

Re: Transforms: why is nullQueue not working?

amiftah — Sat, 08 Sep 2018 02:21:47 GMT

I was missing a Lookahead, because my Content is positioned beyond the 4096 characters which is the default value for lookahead.
Thank you for your answers!

Re: Transforms: why is nullQueue not working?

mstjohn_splunk — Tue, 11 Sep 2018 16:51:13 GMT

hi @amiftah,

It looks like you figured out how to solve your problem. Would you mind approving your answer so that others can better see your solution?

Thanks!