All Apps and Add-ons

Splunk Add-on for Infoblox: Why are sourcetype transformations not working after upgrade to a distributed environment?

bsanch2
Path Finder

We recently moved from a single indexer/search head to a distributed environment. I have a couple of apps/TA's that have sourcetype transforms, one being Splunk Add-on for Infoblox. This TA stopped working after our upgrade. I verified that the props and transforms configs are on the Cluster Master and have been pushed to our two indexers. They are also on the search head. The documentation indicates that the TA supports a distributed environment.

Does anyone have any suggestions on how to troubleshoot this issue? I know the config is good since it was working before. The logs are being ingested from a server with a Universal Forwarder on it, which sets the sourcetype to infoblox:file.

Excerpt from transforms.conf

[infoblox_branch_source_type_1]
DEST_KEY = MetaData:Sourcetype
REGEX = \sdhcpd\[
FORMAT = sourcetype::infoblox:dhcp

[infoblox_branch_source_type_2]
DEST_KEY = MetaData:Sourcetype
REGEX = \snamed\[
FORMAT = sourcetype::infoblox:dns

Excerpt from props.conf

[infoblox:port]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
SHOULD_LINEMERGE = false
DATETIME_CONFIG = NONE
TRUNCATE = 0

[infoblox:file]
TRANSFORMS-0_branch_source_type = infoblox_branch_source_type_1, infoblox_branch_source_type_2
MAX_TIMESTAMP_LOOKAHEAD = 20
SHOULD_LINEMERGE = false
TRUNCATE = 0

Thanks!

1 Solution

sjohnson_splunk
Splunk Employee
Splunk Employee

You didn't mention what the data is now being source typed as now. Still infoblox:file?

btool is your friend. I suggest that you open a terminal session to one of the indexers and run the command:

splunk btool props list --debug > /tmp/props.txt

and

splunk btool transforms list --debug > /tmp/transforms.tx

First examine the props.txt and look for the [infoblox:file] stanza. Make sure that it has the TRANSFORMS-0 setting.

Next examine the transforms.txt file and make sure that it has the actual transforms listed from the props.conf settings.

View solution in original post

cukewu
New Member

Hi,bsanch2
I would like to ask you how to use infoblox add-on this plugin. And get infoblox after syslog done using scenes or dashboards?

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

You didn't mention what the data is now being source typed as now. Still infoblox:file?

btool is your friend. I suggest that you open a terminal session to one of the indexers and run the command:

splunk btool props list --debug > /tmp/props.txt

and

splunk btool transforms list --debug > /tmp/transforms.tx

First examine the props.txt and look for the [infoblox:file] stanza. Make sure that it has the TRANSFORMS-0 setting.

Next examine the transforms.txt file and make sure that it has the actual transforms listed from the props.conf settings.

bsanch2
Path Finder

Thanks for the advice, I wasn't familiar with btool, it's exactly what I needed. I found that the props and transforms for the app weren't being used, which led me to read up on how apps should be deployed in a distributed environment. Our admin placed the apps under the wrong directory on the Master Cluster server. Once I moved them to the correct location, and re-deployed them my sourcetypes began working!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...