Getting Data In

Debugging LINE_BREAKER and TRANSFORMS

mzorzi
Splunk Employee
Splunk Employee

Are there any DEBUG settings I can enable to get more information on how LINE_BREAKER and TRANSFORMS settings are applied at index-time?

Tags (2)
1 Solution

jrodman
Splunk Employee
Splunk Employee

The category.regexExtractionProcessor log category should produce errors for some categories of failing to compile the TRANSFORMS regexes. You could turn up its verbosity to get success messages when building them as well. They do not have debug output after the first matching event comes through.

I've generally found it necessary to use a combination of pcretest, test instances/indexes, bogus fields, and careful tests to determine the cause of TRANSFORMS troubles.

Line breaking similarly will produce output saying what conf is loaded for category.LineBreakingProcessor, ie for a given conf/source/sourcetype, it will say what the truncation length is as well as the lookbehind (if these are set).

View solution in original post

jrodman
Splunk Employee
Splunk Employee

The category.regexExtractionProcessor log category should produce errors for some categories of failing to compile the TRANSFORMS regexes. You could turn up its verbosity to get success messages when building them as well. They do not have debug output after the first matching event comes through.

I've generally found it necessary to use a combination of pcretest, test instances/indexes, bogus fields, and careful tests to determine the cause of TRANSFORMS troubles.

Line breaking similarly will produce output saying what conf is loaded for category.LineBreakingProcessor, ie for a given conf/source/sourcetype, it will say what the truncation length is as well as the lookbehind (if these are set).

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...