Route and filter universal forwarder for two apps

[MicMoo]

Hope everyone is keeping safe.

I'm following this document https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad (Discard specific events and keep the rest)
The first app is working as expected, however when I've created a second app the filtering is not working
Both apps send data to same index, but the apps are on different servers and different logs. we are using Universal Forwarders
App1

[ ~/etc/deployment-apps/app1/local] $ cat props.conf
[uLinga]
TRANSFORMS-set= setnull,setparsing

[ ~/etc/deployment-apps/app1/local] $ cat transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = INFRASFT
DEST_KEY = queue
FORMAT = indexQueue

App2
[ ~/etc/deployment-apps/app2/local] $ cat props.conf
[Aux]
TRANSFORMS-set = setnull,setparsing

[ ~/etc/deployment-apps/app2/local] $ cat transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = INFO|ERROR|WARN
DEST_KEY = queue
FORMAT = indexQueue

Thank you

[MicMoo]

Thank you ,
Managed to sort it out, issue was with the output file on the HF app.

[woodcock]

You need to separate your stanza names so that they are not competing, like this:

[~/etc/deployment-apps/app1/local] $ cat props.conf:

[uLinga]
TRANSFORMS-set= uLinga_setnull, uLinga_setparsing

[ ~/etc/deployment-apps/app1/local] $ cat transforms.conf:

[uLinga_setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[uLinga_setparsing]
REGEX = INFRASFT
DEST_KEY = queue
FORMAT = indexQueue

[ ~/etc/deployment-apps/app2/local] $ cat props.conf:

[Aux]
TRANSFORMS-set = Auz_setnull, Aux_setparsing

[ ~/etc/deployment-apps/app2/local] $ cat transforms.conf:

[Aux_setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[Aux_setparsing]
REGEX = INFO|ERROR|WARN
DEST_KEY = queue
FORMAT = indexQueue

[gjanders]

Run:

splunk btool transforms list --debug

You will likely find that you need to uniquely name your transform stanzas otherwise one will overwrite the other...

[MuS]

Hi MicMoo,

Please post the two apps and their .conf files so people are able to help you.

cheers, MuS