Given the below:
inputs.conf [monitor://\\MyServer\MyFolder] disabled = false host = MyServer index = MyIndex sourcetype = MySourceType ignoreOlderThan = 2d recursive = false whitelist = (MyLog1\d+-\d+\.txt)|(MyLog2\d+-\d+\.txt) props.conf [MySourceType] TRANSFORMS-trash = badError, badError2 BREAK_ONLY_BEFORE_DATE = TRUE SHOULD_LINEMERGE = TRUE TIME_FORMAT = %m/%d/%Y %T TRUNCATE = 0 MAX_DAYS_AGO = 2 sourcetype = MySourceType [source::.../\\Myfolder\\MyLog2*.txt] TRANSFORMS-removejunk = setnull , setparsing [source::..../MyServer\\MyFolder\\MyLog2*.txt] TRANSFORMS-removejunk = setnull , setparsing [source::\\\\MyServer\MyFolder\MyLog2*.txt] TRANSFORMS-removejunk = setnull , setparsing
I'm trying to have a transform just for one of the log files (MyLog2) in the white list. The file is a UNC path and I have tried the 3 naming entries and nothing works. I use
setparsing elsewhere so I know they function properly.
Is there a way to do this by source?
I have a workaround by creating a separate stanza just for this file, but it would be less configuration to be able to use the white list and execute a transform by source name.
I think that the problem is definitely in your
source:: spec. And I believe that it should be
You might want to review the props.conf Global Settings
I learn something new every time I read the props.conf documentation!
Have you checked the file $SPLUNK_HOME/var/log/splunk/splunkd.log for any warnings or errors?
Also, just running
$SPLUNK_HOME/bin/splunk btool check might also turn up something.
I'm running low on ideas...