Apply multiple transforms to a single host

[timbCFCA]

How can I have multiple host stanzas in transforms.conf all be applied? I'd like to pull content out of some entries and discard others.

For example both of these work independently. I want these transforms applied to specific source types on specific hosts.

transforms.conf

[host::MYSERVER]
SOURCE_KEY = _raw
REGEX = (?sm)(.*)This event is generated
DEST_KEY = _raw
FORMAT = $1

[host::MYSERVER]
SOURCE_KEY = _raw
REGEX = (?sm)smsexec
DEST_KEY = queue
FORMAT = nullQueue

props.conf

[WinEventLog:Security]
TRANSFORMS-windows_null3 = windows_null3,host::PATCHES

[somesoni2]

You're going to need both props.conf and transforms.conf entry for your event filtering. Have a look at this.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Keep_specific_...

[timbCFCA]

I'm aware of needing to use props.conf in order to apply my transform. How does this answer apply to how to apply multiple host stanzas?

[somesoni2]

If you want to apply same filtering transforms to multiple hosts, you can create props.conf entry for each of the host, applying same TRANSFORMS stanza. Also if you hosts follow some sort of pattern, you can use wildcard in props.conf stanza name.

[timbCFCA]

Thanks. I want to have multiple transforms applied to the same host, not apply the same transform to multiple hosts.

[somesoni2]

Give this a try. The transforms are applied from right to left of the list provided in props.conf.

props.conf

[host::MYSERVER]
TRANSFORMS-set= setnull,clean_raw_data

transforms.conf

[clean_raw_data]
 SOURCE_KEY = _raw
 REGEX = (?sm)(.*)This event is generated
 DEST_KEY = _raw
 FORMAT = $1

 [setnull]
 SOURCE_KEY = _raw
 REGEX = (?sm)smsexec
 DEST_KEY = queue
 FORMAT = nullQueue

[timbCFCA]

That looks promising. I also only want to apply these transforms for a specific source type.

[WinEventLog:Security]
TRANSFORMS-windows_null3 = windows_null3,host::MYSERVER