Getting Data In

Restriking indexed items

david_fresne
New Member

I have a question on how to restrict what goes into an index.
I have read a number of posts and documentation on how this should work.
In my case I have tried a number of permutations of the props.conf and transforms.conf with no success.
I oneshot the logs in and all the items in the log goes into the index. Here are my props.conf and transforms.conf. Any help would be great.

Thanks

V 1

props.conf

[1033NCL11O]
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\n])
KV_MODE=none
SEGMENTATION-all = inner
TRANSFORMS-set = setnullO
TRANSFORMS-set = setparsingO
TRANSFORMS-servicename = extract-webdata-sernmO

transforms.conf

[setnullO]
REGEX = (INFO|DEBUG)
SOURCE_KEY = queue
FORMAT = nullQueue

[setparsingO]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

V 2

props.conf

[1033NCL11O]
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\n])
KV_MODE=none
SEGMENTATION-all = inner
TRANSFORMS-set = setparsingO
TRANSFORMS-set = setnullO
TRANSFORMS-servicename = extract-webdata-sernmO

transforms.conf

[setnullO]
REGEX = .
SOURCE_KEY = queue
FORMAT = nullQueue

[setparsingO]
REGEX = (TEST|ERROR|WARN|ABT|DEBUG2)
DEST_KEY = queue
FORMAT = indexQueue
Tags (2)
0 Karma

david_fresne
New Member

So what you are saying is that the issue is with the spaces around the equals.

DEST_KEY = queue should be DEST_KEY=queue

Does the spaces around the equals make a difference? If so why?

0 Karma

david_fresne
New Member

So what you are saying is that the issue is with the spaces around the equals.

DEST_KEY = queue should be DEST_KEY=queue

Does the spaces around the equals make a difference? If so why?

0 Karma

lguinn2
Legend

Why not simply

props.conf

[1033NCL11O]
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\n])
KV_MODE=none
SEGMENTATION-all = inner
TRANSFORMS-set = setnullO
TRANSFORMS-servicename = extract-webdata-sernmO

transforms.conf

[setnullO]
REGEX = (INFO|DEBUG)
DEST_KEY = queue
FORMAT = nullQueue

And the real problem is that it should be DEST_KEY=queue

0 Karma

lguinn2
Legend

No the real problem is that you used SOURCE_KEY = queue instead of DEST_KEY = queue in the setnull0 transform...

0 Karma

david_fresne
New Member

So what you are saying is that the issue is with the spaces around the equals.

DEST_KEY = queue should be DEST_KEY=queue

Does spaces around the equals make a difference? If so why?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...