Getting Data In

Apply multiple transforms to a single host

timbCFCA
Path Finder

How can I have multiple host stanzas in transforms.conf all be applied? I'd like to pull content out of some entries and discard others.

For example both of these work independently. I want these transforms applied to specific source types on specific hosts.

transforms.conf

[host::MYSERVER]
SOURCE_KEY = _raw
REGEX = (?sm)(.*)This event is generated
DEST_KEY = _raw
FORMAT = $1

[host::MYSERVER]
SOURCE_KEY = _raw
REGEX = (?sm)smsexec
DEST_KEY = queue
FORMAT = nullQueue

props.conf

[WinEventLog:Security]
TRANSFORMS-windows_null3 = windows_null3,host::PATCHES
0 Karma

somesoni2
Revered Legend

You're going to need both props.conf and transforms.conf entry for your event filtering. Have a look at this.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Keep_specific_...

0 Karma

timbCFCA
Path Finder

I'm aware of needing to use props.conf in order to apply my transform. How does this answer apply to how to apply multiple host stanzas?

0 Karma

somesoni2
Revered Legend

If you want to apply same filtering transforms to multiple hosts, you can create props.conf entry for each of the host, applying same TRANSFORMS stanza. Also if you hosts follow some sort of pattern, you can use wildcard in props.conf stanza name.

0 Karma

timbCFCA
Path Finder

Thanks. I want to have multiple transforms applied to the same host, not apply the same transform to multiple hosts.

0 Karma

somesoni2
Revered Legend

Give this a try. The transforms are applied from right to left of the list provided in props.conf.

props.conf

[host::MYSERVER]
TRANSFORMS-set= setnull,clean_raw_data

transforms.conf

[clean_raw_data]
 SOURCE_KEY = _raw
 REGEX = (?sm)(.*)This event is generated
 DEST_KEY = _raw
 FORMAT = $1

 [setnull]
 SOURCE_KEY = _raw
 REGEX = (?sm)smsexec
 DEST_KEY = queue
 FORMAT = nullQueue
0 Karma

timbCFCA
Path Finder

That looks promising. I also only want to apply these transforms for a specific source type.

[WinEventLog:Security]
TRANSFORMS-windows_null3 = windows_null3,host::MYSERVER
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...