topic Re: How do i clone one sourcetype multiple times? in Getting Data In

How do i clone one sourcetype multiple times?

robertlynch2020 — Wed, 30 Sep 2020 04:16:05 GMT

Currently i copy a sourcetypes with TRANSFORMS-CLONE and it works, example below.
But i want to use TRANSFORMS-CLONE multiple times from the original props.conf is that possible?

Current Situation

Forwarder
[monitor:///net/hp737srv/hp737srv1/apps/TEST/JAVA_11_TEST_FILES/FULL_LOGS_NO2/logs.../*]
sourcetype = G1
crcSalt = <SOURCE>

props.conf
[G1]
TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA

transforms.conf
[CLONE_SOURCETYPE_JAVA]
CLONE_SOURCETYPE = sun_jvm
REGEX = .

However I now have to make more TRANSFORMS-CLONE work from more then 1 (This does not work)

props.conf
[G1]
TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA
TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA2
TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA3

Or if i tried the other way in the to clone in the transforms.conf multiple times (it does not work either)

And use multiple CLONE_SOURCETYPE_JAVA in the transforms.conf, it only pick one of them not the second one.

transforms.conf
[CLONE_SOURCETYPE_JAVA]
CLONE_SOURCETYPE = sun_jvm
REGEX = .

[CLONE_SOURCETYPE_JAVA]
CLONE_SOURCETYPE = GC11
REGEX = .

It does work if i push one to another and then again to another...but this creates a long string. JAVA->GC11->sun_jvm
I want it to come in a sourcetype X. Then copy X to A,B,C and not have a long string

Thanks in Advance for any help
Rob 🙂

Re: How do i clone one sourcetype multiple times?

nickhills — Fri, 21 Feb 2020 12:20:25 GMT

 props.conf
 [G1]
 TRANSFORMS-CLONE = CLONE_SOURCETYPE_JAVA_sun_jvm,CLONE_SOURCETYPE_JAVA_gc11

transforms.conf
 [CLONE_SOURCETYPE_JAVA_sun_jvm]
 CLONE_SOURCETYPE = sun_jvm
 REGEX = .

[CLONE_SOURCETYPE_JAVA_gc11]
 CLONE_SOURCETYPE = GC11
 REGEX = .

Although I'm not sure I understand why you want to do this?

Re: How do i clone one sourcetype multiple times?

robertlynch2020 — Fri, 21 Feb 2020 12:30:47 GMT

perfect, can you change to a an answer and i will accept it please.

Re: How do i clone one sourcetype multiple times?

robertlynch2020 — Fri, 21 Feb 2020 12:53:48 GMT

I need this as the files that come in *.gc.log can be many different garabage collection ways, JAVA 8,9,11 J1 etc.... So i have to take them in and use REGEX to decide what is what.

thanks