Getting Data In

Changes to Tranforms.Conf not reflected

JOverbey
New Member

I have a scripted input that gather SQL Perfmon counters via wmi. It is gathering data and working without issue, however we need to edit it to gather more SQLServer Locks Counters. Below are the entries in the Inputs.Conf, Props.Conf and Transforms.Conf files as well as the .bat file and counters we are calling. I can add counters and these will be gathered without issue however splunk will fail to put it into the intended 'buckets' I list in the Tranforms.Conf file. In fact if I even try to simply change the name of the Format column in the Transforms.conf it does not register in splunk. It is as if once the data is indexed it does not like changes. Also is there a limit on how many REGEX and FORMAT columns I can specify for any scripted input in the Transforms.conf? Any help would be appreciated.

Thank You

Inputs.Conf

[script://$SPLUNK_HOME\etc\apps\sqlwmi\bin\sqlwmi-locks.bat]
interval = 120 
index = sqlserver
sourcetype = WMI:SQLServer:Locks
source = script://sqlwmi-locks.bat

sqlwmi-locks.bat

@echo off
IF EXIST "C:\program files\splunk\etc\apps\sqlwmi\bin" typeperf -cf "C:\program files\splunk\etc\apps\sqlwmi\bin\sql-locks-counters.txt" -sc 1
IF EXIST "D:\program files\splunk\etc\apps\sqlwmi\bin" typeperf -cf "D:\program files\splunk\etc\apps\sqlwmi\bin\sql-locks-counters.txt" -sc 1

sql-locks-counters.txt

\SQLSERVER:Locks(_Total)\Lock Requests/sec
\SQLSERVER:Locks(_Total)\Number of Deadlocks/sec
\SQLSERVER:Locks(_Total)\Lock Waits/sec
\SQLSERVER:Locks(_Total)\Lock Wait Time (ms)
\SQLSERVER:Locks(_Total)\Lock Timeouts/sec

Props.Conf

[source::script://sqlwmi-locks.bat]
LINE_BREAKER = ""
SHOULD_LINEMERGE = true
TRANSFORMS-locks = locks

Transforms.conf

[locks]
DEST_KEY = _raw
REGEX = (?im)"(.*)","([0-9]*\.[0-9]*)","([0-9]*\.[0-9]*)","([0-9]*\.[0-9]*)","([0-9]*\.[0-9]*)","([0-9]*\.[0-9]*)"
FORMAT = $1 LockRequestsPerSec=$2 NumberOfDeadlocksPerSec=$3 LockWaitsPerSec=$4 LockWaitTimeMS=$5 LockTimoutsPerSec=$6
Tags (1)
0 Karma

woodcock
Esteemed Legend

The problem is that you have configured your field extractions as index-time instead of search-time. The former type of extractions are permanently baked in at the time of indexing and cannot be changed after that (but it will change for future events whenever you do make changes in transforms.conf). To change it to a search-time configuration, replace TRANSFORMS-lock with REPORT-lock and be sure to deploy the file to your Search Heads as well as to your Indexers.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2026-2027 SplunkTrust is officially open. If ...