Getting Data In

Route and filter universal forwarder for two apps

MicMoo
Explorer

Hope everyone is keeping safe.

I'm following this document https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad (Discard specific events and keep the rest)
The first app is working as expected, however when I've created a second app the filtering is not working
Both apps send data to same index, but the apps are on different servers and different logs. we are using Universal Forwarders
App1

[ ~/etc/deployment-apps/app1/local] $ cat props.conf
[uLinga]
TRANSFORMS-set= setnull,setparsing

[ ~/etc/deployment-apps/app1/local] $ cat transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = INFRASFT
DEST_KEY = queue
FORMAT = indexQueue

App2
[ ~/etc/deployment-apps/app2/local] $ cat props.conf
[Aux]
TRANSFORMS-set = setnull,setparsing

[ ~/etc/deployment-apps/app2/local] $ cat transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = INFO|ERROR|WARN
DEST_KEY = queue
FORMAT = indexQueue

Thank you

0 Karma

MicMoo
Explorer

Thank you ,
Managed to sort it out, issue was with the output file on the HF app.

0 Karma

woodcock
Esteemed Legend

You need to separate your stanza names so that they are not competing, like this:

[~/etc/deployment-apps/app1/local] $ cat props.conf:

[uLinga]
TRANSFORMS-set= uLinga_setnull, uLinga_setparsing

[ ~/etc/deployment-apps/app1/local] $ cat transforms.conf:

[uLinga_setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[uLinga_setparsing]
REGEX = INFRASFT
DEST_KEY = queue
FORMAT = indexQueue

[ ~/etc/deployment-apps/app2/local] $ cat props.conf:

[Aux]
TRANSFORMS-set = Auz_setnull, Aux_setparsing

[ ~/etc/deployment-apps/app2/local] $ cat transforms.conf:

[Aux_setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[Aux_setparsing]
REGEX = INFO|ERROR|WARN
DEST_KEY = queue
FORMAT = indexQueue
0 Karma

gjanders
SplunkTrust
SplunkTrust

Run:

splunk btool transforms list --debug

You will likely find that you need to uniquely name your transform stanzas otherwise one will overwrite the other...

0 Karma

MuS
Legend

Hi MicMoo,

Please post the two apps and their .conf files so people are able to help you.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...