topic yet another nullQueue question in Splunk Search

yet another nullQueue question

anz_leycurav — Mon, 24 Feb 2014 03:19:32 GMT

Hi,

I've been trawling through the questions / wiki / docs etc, I just cannot see what I'm doing wrong:

everything is under search/local:

inputs.conf:

[monitor://C:\temp\doneFiles\Router##2304899.log]
disabled = false
followTail = 0
sourcetype = task_log

props.conf:

[task_log]
TRANSFORMS-t1 = otherelim

transforms.conf:

[otherelim]
REGEX = (?si)^.*\bRolled\b.*$
DEST_KEY=queue
FORMAT=nullQueue

I'm trying to filter out multiline events containing "Rolled" on any line. In REGEX101.com I get a match as well as in the inline search. In spite of that I'm still collecting those events:

Router##2304899: Mon Feb 24 12:49:17 EST 2014 - Rolling back ...
Router##2304899: Mon Feb 24 12:49:17 EST 2014 - Rolled back.
Router##2304899: Mon Feb 24 12:49:17 EST 2014 - Getting data ...

I also tried activating debug logs on TailProcessor, used btool to check where my source type was loaded from.. what am I missing??

Thanks vincent.

Re: yet another nullQueue question

yannK — Mon, 24 Feb 2014 03:50:50 GMT

It look correct.
Make sure that you deployed the props.conf and transforms.conf on the INDEXERS (and HEAVY FORWARDERS if any).
They have no effect on instances that do not parse the events (universal and lightweight forwarders)

you could change the regex to
REGEX = (?si)\bRolled\b
It's enough to find the lines.

Re: yet another nullQueue question

anz_leycurav — Mon, 24 Feb 2014 03:55:31 GMT

Thanks Yank, I actually started on a Universal forwarder but can't get it to work on my local full install neither.

Assuming all the log levels were set to DEBUG, where could I expect to see the regex being applied?

thanks again