Hi - trying to parse 2 similar sourcetypes with props.conf and transforms.conf but they are not working. Help would be appreciated! Thanks!
Example events:
sourcetype=avaya:epm:mpplogs
@2021-11-19 09:41:54,070|PAVB_03335|INFO|VB|650636|Session=aipor-mpp001lv-2021323144040-7|Got VoiceXML exception: noinput in 9b99c62c5d35f81d18e547137018bef9663c3bc7a33f60a3f25aa4d55d36e14f|aipor-mpp001lv####
sourcetype=avaya:epm:vpmslogs
@2021-11-19 09:51:10,411 EST||FINE|AppIntfService|VoicePortal|ajp-nio-127.0.0.1-3009-exec-41|Method=PackageInfo::GetBuildVersion()| attempt to locate file on classpath. File = VPAppIntfService.aar|||||||aipva-epm001lv|4000064385####
props.conf
[avaya:epm:mpplogs]
REPORT-pipe-separated-fields-mpp = pipe-separated-fields-mpp
[avaya:epm:vpmslogs]
REPORT-pipe-separated-fields-vpms = pipe-separated-fields-vpms
transforms.conf
[pipe-separated-fields-mpp]
DELIMS = "|"
FIELDS = "eventTimestamp","eventName","eventLevel","triggerComponent","eventId","eventText","eventDescription","serverName"
[pipe-separated-fields-vpms]
DELIMS = "|"
FIELDS = "eventTimestamp","eventName","eventLevel","triggerComponent","eventMonitor","eventDescription"
(I've tried with and without quotes)
There's the problem. Parsing with these settings happens at search time so the settings need to be on the search heads.
Yes, testing with verbose mode... none of my fields are appearing.
Should also mention that I'm Cloud, but my app is on a deployment server and being successfully deployed to appropriate clients.
How are you testing this? Are you using Verbose mode?
Yes, testing with verbose mode... none of my fields are appearing.
Should also mention that I'm Cloud, but my app is on a deployment server and being successfully deployed to appropriate clients.
Wait a second. To which clients are you deploying this app?
Hosts where these logs are located...
There's the problem. Parsing with these settings happens at search time so the settings need to be on the search heads.
Got it... will reroute my thinking.. thanks!
Check out https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F and https://www.aplura.com/assets/pdf/where_to_put_props.pdf