How to execute TRANSFORMS by source name in props.conf?

[chrisboy68]

Hi,

Given the below:

inputs.conf

[monitor://\\MyServer\MyFolder]
disabled = false
host = MyServer
index = MyIndex
sourcetype = MySourceType
ignoreOlderThan = 2d
recursive = false
whitelist = (MyLog1\d+-\d+\.txt)|(MyLog2\d+-\d+\.txt)

props.conf

[MySourceType]
TRANSFORMS-trash = badError, badError2
BREAK_ONLY_BEFORE_DATE = TRUE
SHOULD_LINEMERGE = TRUE
TIME_FORMAT = %m/%d/%Y %T
TRUNCATE = 0
MAX_DAYS_AGO = 2
sourcetype = MySourceType


[source::.../\\Myfolder\\MyLog2*.txt]
TRANSFORMS-removejunk = setnull , setparsing

[source::..../MyServer\\MyFolder\\MyLog2*.txt]
TRANSFORMS-removejunk = setnull , setparsing


[source::\\\\MyServer\MyFolder\MyLog2*.txt]
TRANSFORMS-removejunk = setnull , setparsing

I'm trying to have a transform just for one of the log files (MyLog2) in the white list. The file is a UNC path and I have tried the 3 naming entries and nothing works. I use setnull and setparsing elsewhere so I know they function properly.

Is there a way to do this by source?

I have a workaround by creating a separate stanza just for this file, but it would be less configuration to be able to use the white list and execute a transform by source name.

Thank you,

Chris

[maraman_splunk]

are you on a single full instance or in a distributed architecture with some forwarders ?
In the second case, your settings may not be deployed on the correct instance.

[chrisboy68]

Single. No forwarders.

Thanks for trying to help.

Chris

[lguinn2]

I think that the problem is definitely in your source:: spec. And I believe that it should be

[source::\\\\MyServer\\MyFolder\\MyLog2*.txt]

You might want to review the props.conf Global Settings
I learn something new every time I read the props.conf documentation!

[chrisboy68]

Thanks. I just tried :
[source::\\MyServer\MyFolder\MyLog2*.txt]
Still no go. Maybe I'm missing something in reading the props.conf docs...

Chris

[lguinn2]

Have you checked the file $SPLUNK_HOME/var/log/splunk/splunkd.log for any warnings or errors?
Also, just running $SPLUNK_HOME/bin/splunk btool check might also turn up something.

I'm running low on ideas...