How can I parse events in transforms.conf and props.conf?

[jenniferleenyc]

I'm writing transforms.conf and props.conf in /splunk/home/etc/system/local to parse events before a certain string(CERTIFICATE [^0]) and on newlines. This is what I have in props.conf so far:

###props.conf###
###<spec>:sourcetype::qualys###
[sourcetype::qualys]
LINE_BREAKER=?:\([^0]\)CERTIFICATE\s+[^0]|([\n]+)
SHOULD_LINEMERGER=false

Do I need to write anything in transforms.conf? And how can I test my code?

[masonmorales]

You do not need transforms.conf unless you are doing things like scrubbing sensitive data, event-level filtering, field extractions (which you can also add later or just do in props.conf).

You can test by installing Splunk on your laptop, putting the same props.conf on it, and then using the "add data" menu in Splunk web to upload a data sample. Or, if you want to test in a live environment, just make a small test index and send the data there in your inputs.conf. Change it back to the "live" index when you are ready.

Also, you may want to add some other settings for timestamp extraction, time zone, etc. Take a look at this video from .conf 2015 for some best practices: http://conf.splunk.com/session/2015/recordings/2015-splunk-11.mp4
Slides: http://conf.splunk.com/session/2015/conf2015_Aduca_Splunk_Delpoying_OnboardingDataIntoSplunk.pdf

[jenniferleenyc]

Some of my events displayed in Splunk contain several events, which is why I'm trying to filter them in props.conf using LINE_BREAKER. Would that count as "event-level filtering"? Would that require a transforms.conf?

[jenniferleenyc]

Is there a specific way to "put the same props.conf" on the Splunk platform? Or can I keep it in /splunk/home/etc/system/local?