Transforms within cluster not working

jorambokma — Thu, 11 Mar 2021 14:42:18 GMT

Hi,

Within our splunk environment we have 1 search head, 3 search peers, 1 deployer/master/license and 500+ UF. The uf's are configerd with WMI monitoring.

Since the field DisplayName from the WMI output isn't correct extracted, I would like to perform a custom extraction at index time. I know that the search time extractions are the best practice, but since it is a lot of data i would like to do this at index time.

So this is what I did;

Deployed prop.conf and tranforms.conf on the search peers.

Props.conf

[source::WMI...] TRANSFORMS-Display = DisplayNametrans SHOULD_LINEMERGE = false

transforms.conf

[DisplayNametrans] REGEX = DisplayName=(?<DisplayName2>.*)\nName FORMAT = DisplayName2::$1 WRITE_META = true

Created fields.conf on the search head

fields.conf

[DisplayName2] INDEXED=true

After restarting everything, nothing happend....

To troubleshoot a little further, I changed the function TRANSFORMS-Display to REPORT-Display and then it's working which means my regex works...

Does somebody has an idea what i do wrong?

Kind regards, Joram

Re: Transforms within cluster not working

scelikok — Sat, 13 Mar 2021 11:52:01 GMT

Hi @jorambokma,

Are you getting WMI data using a heavy forwarder? If yes you should place props.conf and transforms.conf into that HF.

Re: Transforms within cluster not working

jorambokma — Mon, 15 Mar 2021 08:59:14 GMT

Hi @scelikok,

Thanks for the response.

No, the UF's send their data directly to the search peers.

topic Re: Transforms within cluster not working in Getting Data In

Transforms within cluster not working

Re: Transforms within cluster not working

Re: Transforms within cluster not working