Getting Data In

How to use config to get rid of multipath error?

m_zandinia
Explorer

Hi Splunkers!

I have a problem with props.conf and tranforms.conf

I face with this error in Linux Servers.

 

multipathd[212317]: sdb: failed to get sgio uid: No such file or directory
multipathd[212317]: sdb: add missing path

 

So I set props.conf and transforms.conf to get rid of this messages.

It seems correct and I can't figure out why this doesn't work?!

 

props.conf
[syslog]
TRANSFORMS-null = setnull

 

 

transorms.conf
[setnull]
REGEX = multipathd
DEST_KEY = queue
FORMAT = nullQueue

 

I also tried these REGEXs

 

REGEX = .*multipathd.*
REGEX = (.+multipathd.+)

 

But nothing happened

So where did I make a mistake?

appreciate for your time

Labels (2)
Tags (2)
0 Karma
1 Solution

gcusello
Legend

Hi @m_zandinia,

let me understand: do you want to discard events where is present the word "multipathd" or what else?

if this is what you want the props and transfroms you used are correct.

If you want something else, please describe your need.

In addition, where do you located these props and transforms?

They must be on Indexers or (when present) on Heavy Forwarders, not on Universal Forwarders.

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @m_zandinia,

let me understand: do you want to discard events where is present the word "multipathd" or what else?

if this is what you want the props and transfroms you used are correct.

If you want something else, please describe your need.

In addition, where do you located these props and transforms?

They must be on Indexers or (when present) on Heavy Forwarders, not on Universal Forwarders.

Ciao.

Giuseppe

m_zandinia
Explorer

Thanks @gcusello

Is works perfectly when I set it on indexers.  I set those settings on UF and because of that it didn't work.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...