Getting Data In

Path of props.conf and transforms.conf

prajnasaha
Loves-to-Learn

I'd like to monitor log files and ingest specific lines from these files. My props.conf and transforms.conf has no error. But for some reason the props.conf is not working and instead of indexing specific lines , it is indexing the whole log. Is there any specific path to place .conf files, or any other solution?

0 Karma

glc_slash_it
Path Finder

Hi,

can you paste your confs here? Usually the proper way of doing it would look something like this:

transforms.conf
[filter_some_events]
REGEX = <regex_that_matches_the_events_you_want>
DEST_KEY = _MetaData:Index
FORMAT = <your_index>

props.conf
[<sourcetype_stanza>]
...other_props_configs...
TRANSFORMS-filter_name = filter_some_events

 

0 Karma

prajnasaha
Loves-to-Learn

Hi @glc_slash_it , here it is. Although I am not getting the specific lines, instead the whole log is getting indexed.

 

transforms.conf
[err_line]
REGEX = ^(?!.error)
DEST_KEY = _MetaData:Index
FORMAT = error_idx

props.conf
[err_src]
TRANSFORMS-err_line = err_line

 

 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...