Getting Data In

I am unable to remove the standard Blue Coat heades tha begin with the # comment. I have tried several iterations of the nullQueue using REGEX and SEDCMD

babcolee
Path Finder

This is a copy of the log header and how I currently have the props.conf and transforms.conf configured

Software: SGOS 6.5.9.8

Version: 1.0

Start-Date: 2016-11-10 08:19:24

Date: 2016-08-12 01:46:28

Fields: date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-bluecoat-application-name x-bluecoat-application-operation x-bluecoat-transaction-uuid x-icap-reqmod-header(X-ICAP-Metadata) x-icap-respmod-header(X-ICAP-Metadata)

Remark: 4111140007 "fdc-bcoat-2" "140.108.3.12" "GSOCLogFeed"

props.conf
[bluecoat:proxysg:access:syslog]
TRANSFORMS-null = TrashHeader

transforms.conf
[TrashHeader]
REGEX = ^#
DEST_KEY = queue
FORMAT = nullQueue

Tags (2)
0 Karma

Azeemering
Builder

Late answer but maybe it will benefit someone who searches for the same in the future:
You have ^# that will discard all events that start with #
Your props and transforms look fine.

I think the main question is when do you want to discard them? At index time you need to make sure you place them on the indexers (or in etc/system/local on single install of splunk). Also make sure you restart splunk to make the settings active.

Whatever you do make sure you troubleshoot if the props and transform settings are active.
Use btool:

$SPLUNK_HOME/bin/splunk cmd btool props list

0 Karma

babcolee
Path Finder

Thank you for your response. Unfortunately, the Blue Coat header is still showing with the events

0 Karma

gokadroid
Motivator

Can you try to replace your regex of REGEX=^# to REGEX=^#.*$ and see if it works. See here for sample.

0 Karma

babcolee
Path Finder

Thank you for your response. Unfortunately, the Blue Coat header is still showing with the events

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...