I need to filter evevnts like below to be indexed. (Data coming from UF to Indexers [using indexer cluster])
_raw Row 375: account_id[.....some text ........some other text Row 374: account_id[.....some text ........some other text Row 373: account_id[.....some text ........some other text
[some sourcetype] TRANSFORMS-removejunk = removerows
[removerows] REGEX = ^Row\s+\d+\: DEST_KEY = queue FORMAT = nullQueue
It's not working. Can anyone help?
Could please provide more information like:
splunk btool props listto see if it's applied correct
splunk btool transforms listto see if it's applied correct
Where do you have this installed at? Since UF cannot do parsing, this needs to be installed either on a HF, in between your UF and Indexers, or on the Indexers and configured for the designated Sourcetype.
The configurations looks good to me. Make sure you're deploying to correct Splunk Instance (Indexers in your case as you mentioned it's coming from UF to Indexer Cluster). Make sure you put the props/transforms using Cluster Master and then pushed the cluster bundle to Indexers. For reference, here is how that's done.