https://community.splunk.com/t5/Getting-Data-In/How-can-I-parse-events-in-transforms-conf-and-props-conf/m-p/287820#M99239 <P>Is there a specific way to "put the same props.conf" on the Splunk platform? Or can I keep it in /splunk/home/etc/system/local? </P> Thu, 28 Jul 2016 18:59:33 GMT jenniferleenyc 2016-07-28T18:59:33Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-parse-events-in-transforms-conf-and-props-conf/m-p/287817#M99236 <P>I'm writing transforms.conf and props.conf in /splunk/home/etc/system/local to parse events before a certain string(CERTIFICATE [^0]) and on newlines. This is what I have in props.conf so far:</P> <PRE><CODE>###props.conf### ###&lt;spec&gt;:sourcetype::qualys### [sourcetype::qualys] LINE_BREAKER=?:\([^0]\)CERTIFICATE\s+[^0]|([\n]+) SHOULD_LINEMERGER=false </CODE></PRE> <P>Do I need to write anything in transforms.conf? And how can I test my code?</P> Thu, 28 Jul 2016 15:44:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-parse-events-in-transforms-conf-and-props-conf/m-p/287817#M99236 jenniferleenyc 2016-07-28T15:44:35Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-parse-events-in-transforms-conf-and-props-conf/m-p/287818#M99237 <P>You do not need transforms.conf unless you are doing things like scrubbing sensitive data, event-level filtering, field extractions (which you can also add later or just do in props.conf). </P> <P>You can test by installing Splunk on your laptop, putting the same props.conf on it, and then using the "add data" menu in Splunk web to upload a data sample. Or, if you want to test in a live environment, just make a small test index and send the data there in your inputs.conf. Change it back to the "live" index when you are ready. </P> <P>Also, you may want to add some other settings for timestamp extraction, time zone, etc. Take a look at this video from .conf 2015 for some best practices: <A href="http://conf.splunk.com/session/2015/recordings/2015-splunk-11.mp4">http://conf.splunk.com/session/2015/recordings/2015-splunk-11.mp4</A><BR /> Slides: <A href="http://conf.splunk.com/session/2015/conf2015_Aduca_Splunk_Delpoying_OnboardingDataIntoSplunk.pdf">http://conf.splunk.com/session/2015/conf2015_Aduca_Splunk_Delpoying_OnboardingDataIntoSplunk.pdf</A></P> Thu, 28 Jul 2016 15:50:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-parse-events-in-transforms-conf-and-props-conf/m-p/287818#M99237 masonmorales 2016-07-28T15:50:29Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-parse-events-in-transforms-conf-and-props-conf/m-p/287819#M99238 <P>Some of my events displayed in Splunk contain several events, which is why I'm trying to filter them in props.conf using LINE_BREAKER. Would that count as "event-level filtering"? Would that require a transforms.conf?</P> Thu, 28 Jul 2016 15:59:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-parse-events-in-transforms-conf-and-props-conf/m-p/287819#M99238 jenniferleenyc 2016-07-28T15:59:01Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-parse-events-in-transforms-conf-and-props-conf/m-p/287820#M99239 <P>Is there a specific way to "put the same props.conf" on the Splunk platform? Or can I keep it in /splunk/home/etc/system/local? </P> Thu, 28 Jul 2016 18:59:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-parse-events-in-transforms-conf-and-props-conf/m-p/287820#M99239 jenniferleenyc 2016-07-28T18:59:33Z