Getting Data In

Apply multiple transforms to a single host

timbCFCA
Path Finder

How can I have multiple host stanzas in transforms.conf all be applied? I'd like to pull content out of some entries and discard others.

For example both of these work independently. I want these transforms applied to specific source types on specific hosts.

transforms.conf

[host::MYSERVER]
SOURCE_KEY = _raw
REGEX = (?sm)(.*)This event is generated
DEST_KEY = _raw
FORMAT = $1

[host::MYSERVER]
SOURCE_KEY = _raw
REGEX = (?sm)smsexec
DEST_KEY = queue
FORMAT = nullQueue

props.conf

[WinEventLog:Security]
TRANSFORMS-windows_null3 = windows_null3,host::PATCHES
0 Karma

somesoni2
Revered Legend

You're going to need both props.conf and transforms.conf entry for your event filtering. Have a look at this.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Keep_specific_...

0 Karma

timbCFCA
Path Finder

I'm aware of needing to use props.conf in order to apply my transform. How does this answer apply to how to apply multiple host stanzas?

0 Karma

somesoni2
Revered Legend

If you want to apply same filtering transforms to multiple hosts, you can create props.conf entry for each of the host, applying same TRANSFORMS stanza. Also if you hosts follow some sort of pattern, you can use wildcard in props.conf stanza name.

0 Karma

timbCFCA
Path Finder

Thanks. I want to have multiple transforms applied to the same host, not apply the same transform to multiple hosts.

0 Karma

somesoni2
Revered Legend

Give this a try. The transforms are applied from right to left of the list provided in props.conf.

props.conf

[host::MYSERVER]
TRANSFORMS-set= setnull,clean_raw_data

transforms.conf

[clean_raw_data]
 SOURCE_KEY = _raw
 REGEX = (?sm)(.*)This event is generated
 DEST_KEY = _raw
 FORMAT = $1

 [setnull]
 SOURCE_KEY = _raw
 REGEX = (?sm)smsexec
 DEST_KEY = queue
 FORMAT = nullQueue
0 Karma

timbCFCA
Path Finder

That looks promising. I also only want to apply these transforms for a specific source type.

[WinEventLog:Security]
TRANSFORMS-windows_null3 = windows_null3,host::MYSERVER
0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...