I have these types of logs coming into Splunk today from 3 heavy forwarders (syslog servers) via inputs.conf apps I've deployed from a deployer.
Sep 27 07:11:08 hq1acptrvra1202.me.com ea_tomcat: env=ACPT profile=claymore Sep 27 07:11:08 hq1acptrvra1202.me.com ea_tomcat: env=ACPT profile=claymore (nmon) CMD (/etc/nmon-logger/bin/nmon_helper.sh /etc/nmon-logger /var/log/nmon-logger >> /var/log/nmon-logger/nmon_collect.log 2>&1)
I want to send all events with "nmon" in them to the Null Queue. I created an app to send out props/tranforms to the Heavy Forwarders and for consistency I sent the same to our cluster of indexers. Logs are still coming in. What are we missing?
everything segment after /vcaclog/ can be dynamic.
[source::/vcaclog/*] TRANSFORMS-null= setnull-test
[setnull-test] REGEX = (?m)(nmon) DEST_KEY = queue FORMAT = nullQueue