topic I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective? in Splunk Search

I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

hylam — Tue, 29 Sep 2020 07:55:07 GMT

I have disabled the transform stanza in the GUI, but the regex field extractions are still effective. What's wrong?

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles

[<spec>]
REPORT-<class> = <unique_transform_stanza_name1>, <unique_transform_stanza_name2>,...

props.conf:REPORT-apNameList = apNameList
transforms.conf:[apNameList]
transforms.conf:disabled = 1

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

krish3 — Sun, 15 Nov 2015 05:12:42 GMT

I do not see any disabled argument in stanza's of transforms.conf

Just try commenting out the configuration and restart the instance.

Let me know how it goes... 🙂

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

hylam — Sun, 15 Nov 2015 05:17:07 GMT

GUI problem?

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

krish3 — Sun, 15 Nov 2015 05:25:29 GMT

What do you mean by GUI problem?

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

hylam — Sun, 15 Nov 2015 05:29:35 GMT

I navigated to Fields » Field transformations. Then I clicked disable in that row. Has the GUI produced "disabled = 1" which is undefined in transforms.conf.spec?

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

krish3 — Sun, 15 Nov 2015 05:35:02 GMT

Okay did you restart the instance??

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

hylam — Sun, 15 Nov 2015 05:41:07 GMT

I did not restart the instance. After disabling the transform stanza thru the GUI, I hit http://localhost:8000/debug/refresh.

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

krish3 — Sun, 15 Nov 2015 05:58:32 GMT

Try this http://yoursplunkserver:8000/en-us/debug/refresh?entity=admin/transforms-lookup

Or if not please try a restart that should fix the issue.

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

hylam — Sun, 15 Nov 2015 06:10:57 GMT

I tried all 3. The regex transform is still working. What is the "disabled = 1" in transforms.conf for? Why is the GUI for disabling transform stanzas there?

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

frmaasdam — Sun, 15 Nov 2015 17:36:39 GMT

You can check your eventually combined transforms.conf by executing the command.
splunk cmd btool transforms list.
Then you can check which transforms are active or not.

Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

woodcock — Sun, 15 Nov 2015 20:09:02 GMT

There are things that create fields automatically; you should make sure that you set KV_MODE = none also. Post an example event and the fields that shouldn't be there.