Props/transforms rewrite of _raw is adding a blank event

[Glenn]

Hi,

I am using a props/transforms TRANSFORM to add the source (log file) name to the _raw log event line.

props.conf:

[GC_throughput]
TRANSFORMS-GC_throughput = GC_add_source

transforms.conf

[GC_add_source]
SOURCE_KEY = MetaData:Source
REGEX = ^source::(.*)$
FORMAT = $1 $0
DEST_KEY = _raw

For some reason an "extra", event is being created on the Splunk server which is empty apart from the added source field. It doesn't even have a timestamp or anything, so is given a timestamp at the time it was indexed.

Ie. when not using the props/transforms, there are two events:

2012-02-17T13:19:43.101+0000: 1906587.847: [GC [PSYoungGen: 261184K->608K(261440K)] 422309K->161797K(1047872K), 0.0133890 secs]
2012-02-17T12:45:13.623+0000: 1904518.369: [GC [PSYoungGen: 261024K->384K(261504K)] 422093K->161509K(1047936K), 0.0166770 secs] [Times: user=0.01 sys=0.00, real=0.01 secs] 

When I use the props/transform:

/tmp/verboseSunGC.log
/tmp/verboseSunGC.log 2012-02-17T13:19:43.101+0000: 1906587.847: [GC [PSYoungGen: 261184K->608K(261440K)] 422309K->161797K(1047872K), 0.0133890 secs]
/tmp/verboseSunGC.log 2012-02-17T12:45:13.623+0000: 1904518.369: [GC [PSYoungGen: 261024K->384K(261504K)] 422093K->161509K(1047936K), 0.0166770 secs] [Times: user=0.01 sys=0.00, real=0.01 secs] 

Why is this, and/or what am I doing wrong?

[jeff]

I'm totally guessing here, but the REGEX might be picking up a cr/lf after source, then inserting that into the _raw data, which is then being interpreted as a separate event.

How does it work if you try:

REGEX = ^source::([^\r\n]+)