topic Re: Route and filter universal forwarder for two apps in Getting Data In

Route and filter universal forwarder for two apps

MicMoo — Mon, 30 Mar 2020 23:20:38 GMT

Hope everyone is keeping safe.

I'm following this document https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad (Discard specific events and keep the rest)
The first app is working as expected, however when I've created a second app the filtering is not working
Both apps send data to same index, but the apps are on different servers and different logs. we are using Universal Forwarders
App1

[ ~/etc/deployment-apps/app1/local] $ cat props.conf
[uLinga]
TRANSFORMS-set= setnull,setparsing

[ ~/etc/deployment-apps/app1/local] $ cat transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = INFRASFT
DEST_KEY = queue
FORMAT = indexQueue

App2
[ ~/etc/deployment-apps/app2/local] $ cat props.conf
[Aux]
TRANSFORMS-set = setnull,setparsing

[ ~/etc/deployment-apps/app2/local] $ cat transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = INFO|ERROR|WARN
DEST_KEY = queue
FORMAT = indexQueue

Thank you

Re: Route and filter universal forwarder for two apps

MuS — Tue, 31 Mar 2020 00:06:05 GMT

Hi MicMoo,

Please post the two apps and their .conf files so people are able to help you.

cheers, MuS

Re: Route and filter universal forwarder for two apps

gjanders — Fri, 03 Apr 2020 00:32:39 GMT

Run:

splunk btool transforms list --debug

You will likely find that you need to uniquely name your transform stanzas otherwise one will overwrite the other...

Re: Route and filter universal forwarder for two apps

woodcock — Fri, 03 Apr 2020 12:27:40 GMT

You need to separate your stanza names so that they are not competing, like this:

[~/etc/deployment-apps/app1/local] $ cat props.conf:

[uLinga]
TRANSFORMS-set= uLinga_setnull, uLinga_setparsing

[ ~/etc/deployment-apps/app1/local] $ cat transforms.conf:

[uLinga_setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[uLinga_setparsing]
REGEX = INFRASFT
DEST_KEY = queue
FORMAT = indexQueue

[ ~/etc/deployment-apps/app2/local] $ cat props.conf:

[Aux]
TRANSFORMS-set = Auz_setnull, Aux_setparsing

[ ~/etc/deployment-apps/app2/local] $ cat transforms.conf:

[Aux_setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[Aux_setparsing]
REGEX = INFO|ERROR|WARN
DEST_KEY = queue
FORMAT = indexQueue

Re: Route and filter universal forwarder for two apps

MicMoo — Sun, 05 Apr 2020 21:20:27 GMT

Thank you ,
Managed to sort it out, issue was with the output file on the HF app.