How to Exclude header data in cisco log file ?

[dfigurello]

Hi splunkers,

I would like to remove headers from a Cisco file. I've tried transforms configurations, but I can't get it work.
I ran a search to troubleshoot: index=_internal sourcetype=splunkd ignoreComments , with the following results:

 -0200 ERROR regexExtractionProcessor - REGEX field must be specified
 tranform_name=ignoreComments

Please find below details of the configurations:

C:\Program Files\Splunk\etc\apps\search\local\inputs.conf

[monitor://c:\cisco\*]
sourcetype = cisco_teste
disabled = false
index = treinamento

C:\Program Files\Splunk\etc\apps\search\local\props.conf

[cisco_teste]
TRANSFORMS-noComments = ignoreComments

C:\Program Files\Splunk\etc\apps\search\local\tranforms.conf

[ignoreComments]
REGEX = ^#
DEST_KEY = queue
FORMAT = nullQueue

Let me know if you guys need anything else, I really appreciate the help.
Cheers,

[woodcock]

Did you restart the Splunk instances on the Indexers where you put props.conf and transforms.conf?
Double-check this list:

• The sourcetype matches replace_sourcetype_with_containing_directory exactly (casing, punctuation, etc.).
• The props.conf and transforms.conf configuration files are deployed to the Indexers or Heavy Forwarders (or Universal Forwarders in some cases, such as INDEXED_EXTRACTIONS = CSV).
• The inputs.conf configuration file is deployed to the Forwarder.
• You must restart/bounce all Splunk instances on the servers where you deploy these files.
• There are no configuration errors during restart (watch the response text during startup on one server of each type).
• You are verifying proper current function by looking at NEW data (post-deploy/post-bounce), not previously indexed data (which is immutable).

[s2_splunk]

You specified "ignoreComment" in props.conf, but you configured "ignoreComments" as the transforms.conf.
Make sure spelling exactly matches.

[s2_splunk]

You may want to match the full line that starts with '#', i.e. do REGEX=^#.*
I cannot see anything else that is wrong with your configuration. And you are configuring these files on your indexer, correct?

[s2_splunk]

Overlap with woodcock....

[dfigurello]

Hi ssievert,,

I am sorry but i did make a mistake when I put here in answers, please disregard it.

Tks.

[woodcock]

You have a spelling mismatch; you need to settle on either ignoreComment or ignoreComments (note the extra s in the latter). Once you make this the same, it should work fine.

[dfigurello]

Hi Woodcock,

I am sorry but i did make a mistake when I put here in answers, please disregard it.

Tks.