topic Need to prevent pattern from being parsed and shown in to the logs. in Getting Data In

Need to prevent pattern from being parsed and shown in to the logs.

saxenaamit — Tue, 29 Sep 2020 10:34:58 GMT

I am trying to parse this message and sending "Timer_ConnectionIdle" in to nullQueue. I am not using heavy forwarders so that I can't use props.conf and transforms.conf files in the app deployment folder ( where we have inputs.conf file for the related index). I am trying to change/ create files ( props.conf or transforms.conf) in SPLUNK_HOME/etc/system/local as suggested in articles to use indexers if there is a light forwarder.

2016-08-09 14:26:23 10.30.70.180 54809 10.30.15.216 80 - - - - - Timer_ConnectionIdle -
2016-08-09 14:23:28 10.30.60.203 57988 10.30.15.241 80 HTTP/1.1 GET /Ops/Main.asp?Bus_Unit=800024&busUnit=800024&country_id=US&RegionCode=&TabSelect=7&WhichTab=&type=summary - 27 Client_Reset sitedataasp.uat.crowncastle.com+AppPool

I am not getting this working even though I tried changing the location of props.conf and transforms.conf as well as configuration.

Transforms.conf
[null_filter]
REGEX=Timer_ConnectionIdle
DEST_KEY=queue
FORMAT=nullQueue

props.conf
[source::C:\Windows\System32\LogFiles\HTTPERR\httperr54.log]
TRANSFORMS-null=null_filter

Re: Need to prevent pattern from being parsed and shown in to the logs.

sundareshr — Wed, 10 Aug 2016 22:54:39 GMT

Try this, restart splunk

Transforms.conf
[null_filter]
REGEX=Timer_ConnectionIdle
DEST_KEY=queue
FORMAT=nullQueue

props.conf
[source::C:\\Windows\\System32\\LogFiles\\HTTPERR\\httperr54.log]
TRANSFORMS-null=null_filter

Re: Need to prevent pattern from being parsed and shown in to the logs.

saxenaamit — Thu, 11 Aug 2016 13:10:15 GMT

Thanks Sunder. I have already tried it before and didn't get it working.

Re: Need to prevent pattern from being parsed and shown in to the logs.

sundareshr — Thu, 11 Aug 2016 14:35:48 GMT

Did you try escaping the \ And is this on the indexer? Then I would suggest try using sourcetype stanze. Maybe something with the source stanza

Re: Need to prevent pattern from being parsed and shown in to the logs.

jkat54 — Thu, 11 Aug 2016 14:36:37 GMT

Put the props and transforms on the universal forwarder AND the indexers.

Re: Need to prevent pattern from being parsed and shown in to the logs.

saxenaamit — Thu, 11 Aug 2016 15:07:40 GMT

Did you try escaping the `` - I didn't get about what you are indicating.
And is this on the indexer- Yes, we are not using heavy forwarders so, I found that we need to use indexers to get this working.
Then I would suggest try using sourcetype stanze. Maybe something with the source stanza- I have tried with sourceType instead of using source. SourceType value what I used came from inputs.conf. I did't get it working.

Can you list steps to configure by which we can send data to nullQueue without using heavy forwarders? It seems I might be missing a step.