https://community.splunk.com/t5/Getting-Data-In/syslog-ng-props-and-transforms-conf-for-ingesting-data/m-p/467228#M80531 <P>Hi!</P> <P>I'm trying to ingest metric data from a Virtual Machine Linux box, using syslog-ng and Splunk Universal Forwarder. It's for an application, so on my windows box I'm trying to make the configuration files for transforms and props in /etc/apps/app_name/local directory. It's currently working for another box with rsyslog instead of syslog-ng. For some reason it isn't with syslog-ng.</P> <P>transforms.conf</P> <P>[syslog-ng_stats]<BR /> INGEST_EVAL = metric_name=Metric</P> <P>[object_extraction-ng]<BR /> DELIMS=";"<BR /> FIELDS=Date,Hostname,Object,Id,Instance,Status,Type,Metric<BR /> WRITE_META = true</P> <P>[metric-schema:extract_stats_metrics-ng]<BR /> METRIC-SCHEMA-MEASURES-ngstats=Hostname,Object,Id,Instance,Status,Type,Metric</P> <P>props.conf</P> <P>[syslog-ng-ctl]<BR /> TRANSFORMS-fieldvalue=field_extraction<BR /> TRANSFORMS-metricslog=syslog-ng_stats<BR /> TRANSFORMS-object=object_extraction-ng<BR /> METRIC-SCHEMA-TRANSFORMS=metric-schema:extract_stats_metrics-ng</P> <P>I'm pretty sure these are the issue as to why it isn't working, but I don't know what I've done wrong.</P> <P>I hope I explained this properly. If you need more information, let me know. I would greatly appreciate some help on this, I'm stuck.</P> Wed, 30 Sep 2020 03:23:39 GMT chrisratliff95 2020-09-30T03:23:39Z https://community.splunk.com/t5/Getting-Data-In/syslog-ng-props-and-transforms-conf-for-ingesting-data/m-p/467228#M80531 <P>Hi!</P> <P>I'm trying to ingest metric data from a Virtual Machine Linux box, using syslog-ng and Splunk Universal Forwarder. It's for an application, so on my windows box I'm trying to make the configuration files for transforms and props in /etc/apps/app_name/local directory. It's currently working for another box with rsyslog instead of syslog-ng. For some reason it isn't with syslog-ng.</P> <P>transforms.conf</P> <P>[syslog-ng_stats]<BR /> INGEST_EVAL = metric_name=Metric</P> <P>[object_extraction-ng]<BR /> DELIMS=";"<BR /> FIELDS=Date,Hostname,Object,Id,Instance,Status,Type,Metric<BR /> WRITE_META = true</P> <P>[metric-schema:extract_stats_metrics-ng]<BR /> METRIC-SCHEMA-MEASURES-ngstats=Hostname,Object,Id,Instance,Status,Type,Metric</P> <P>props.conf</P> <P>[syslog-ng-ctl]<BR /> TRANSFORMS-fieldvalue=field_extraction<BR /> TRANSFORMS-metricslog=syslog-ng_stats<BR /> TRANSFORMS-object=object_extraction-ng<BR /> METRIC-SCHEMA-TRANSFORMS=metric-schema:extract_stats_metrics-ng</P> <P>I'm pretty sure these are the issue as to why it isn't working, but I don't know what I've done wrong.</P> <P>I hope I explained this properly. If you need more information, let me know. I would greatly appreciate some help on this, I'm stuck.</P> Wed, 30 Sep 2020 03:23:39 GMT https://community.splunk.com/t5/Getting-Data-In/syslog-ng-props-and-transforms-conf-for-ingesting-data/m-p/467228#M80531 chrisratliff95 2020-09-30T03:23:39Z