Getting Data In


New Member

While attempting to clone (and mask) events that belong to select source patterns,. the CLONE_SOURCETYPE doesn't honor the REGEX. The goal is to restrict cloning to those events that have dev or tst in their source.  So prod or perf or uat etc wouldn't get cloned. 

it seems that the no matter what the REGEX in the clone stanza in transforms, the events gets cloned. 

The temporary solution was to run a nullQueue for those non-dev and non-tst sources.

What am I doing wrong here?  Any thoughts/suggestions? Note -The test file doesn't have any source defined. The only place I supply a source is using the rename-source argument as below


# Code fragment 

How I run this using oneshot -

splunk add oneshot test-foo.txt -rename-source "sfdc_object://User_splunk_dev_cnf" -index mask  -sourcetype sfdc:orig -host dev_01 [WORKS- clones should be created. Works as expected]

splunk add oneshot test-foo.txt -rename-source "sfdc_object://User_splunk_prod_cnf" -index mask  -sourcetype sfdc:orig -host dev_02  [DOESN'T WORK - clones shouldn't be created, but they are]


TRANSFORMS-sfdc-orig = sfdc_cloner

EVAL-mn = "foo"


# sources are one of the following -  sfdc_object://User_splunk_dev_cnf sfdc_object://User_splunk_tst_cnf      sfdc_object://User_splunk_prod_cnf ...

#Only clone those where sources don't have _prod_ 
REGEX = ^(?=.*(dev|tst)).*
# Tried this as well - no bueno
#REGEX = (sfdc_object:.*(dev|tst)_cnf.*)

SOURCE_KEY = MetaData:Source
DEST_KEY = _raw

Labels (1)
Tags (1)
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!