Getting Data In

Route and filter universal forwarder for two apps

MicMoo
Explorer

Hope everyone is keeping safe.

I'm following this document https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad (Discard specific events and keep the rest)
The first app is working as expected, however when I've created a second app the filtering is not working
Both apps send data to same index, but the apps are on different servers and different logs. we are using Universal Forwarders
App1

[ ~/etc/deployment-apps/app1/local] $ cat props.conf
[uLinga]
TRANSFORMS-set= setnull,setparsing

[ ~/etc/deployment-apps/app1/local] $ cat transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = INFRASFT
DEST_KEY = queue
FORMAT = indexQueue

App2
[ ~/etc/deployment-apps/app2/local] $ cat props.conf
[Aux]
TRANSFORMS-set = setnull,setparsing

[ ~/etc/deployment-apps/app2/local] $ cat transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = INFO|ERROR|WARN
DEST_KEY = queue
FORMAT = indexQueue

Thank you

0 Karma

MicMoo
Explorer

Thank you ,
Managed to sort it out, issue was with the output file on the HF app.

0 Karma

woodcock
Esteemed Legend

You need to separate your stanza names so that they are not competing, like this:

[~/etc/deployment-apps/app1/local] $ cat props.conf:

[uLinga]
TRANSFORMS-set= uLinga_setnull, uLinga_setparsing

[ ~/etc/deployment-apps/app1/local] $ cat transforms.conf:

[uLinga_setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[uLinga_setparsing]
REGEX = INFRASFT
DEST_KEY = queue
FORMAT = indexQueue

[ ~/etc/deployment-apps/app2/local] $ cat props.conf:

[Aux]
TRANSFORMS-set = Auz_setnull, Aux_setparsing

[ ~/etc/deployment-apps/app2/local] $ cat transforms.conf:

[Aux_setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[Aux_setparsing]
REGEX = INFO|ERROR|WARN
DEST_KEY = queue
FORMAT = indexQueue
0 Karma

gjanders
SplunkTrust
SplunkTrust

Run:

splunk btool transforms list --debug

You will likely find that you need to uniquely name your transform stanzas otherwise one will overwrite the other...

0 Karma

MuS
Legend

Hi MicMoo,

Please post the two apps and their .conf files so people are able to help you.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...