Hi Splunkers!
I have a problem with props.conf and tranforms.conf
I face with this error in Linux Servers.
multipathd[212317]: sdb: failed to get sgio uid: No such file or directory
multipathd[212317]: sdb: add missing path
So I set props.conf and transforms.conf to get rid of this messages.
It seems correct and I can't figure out why this doesn't work?!
props.conf
[syslog]
TRANSFORMS-null = setnull
transorms.conf
[setnull]
REGEX = multipathd
DEST_KEY = queue
FORMAT = nullQueue
I also tried these REGEXs
REGEX = .*multipathd.*
REGEX = (.+multipathd.+)
But nothing happened
So where did I make a mistake?
appreciate for your time
Hi @m_zandinia,
let me understand: do you want to discard events where is present the word "multipathd" or what else?
if this is what you want the props and transfroms you used are correct.
If you want something else, please describe your need.
In addition, where do you located these props and transforms?
They must be on Indexers or (when present) on Heavy Forwarders, not on Universal Forwarders.
Ciao.
Giuseppe
Hi @m_zandinia,
let me understand: do you want to discard events where is present the word "multipathd" or what else?
if this is what you want the props and transfroms you used are correct.
If you want something else, please describe your need.
In addition, where do you located these props and transforms?
They must be on Indexers or (when present) on Heavy Forwarders, not on Universal Forwarders.
Ciao.
Giuseppe
Thanks @gcusello
Is works perfectly when I set it on indexers. I set those settings on UF and because of that it didn't work.