I am using SETNULL and SETPARSING to include and exclude log events. Here is the files -
Props.conf
[OktaIM2:log]
TRANSFORMS-set= setnull,setparsing
transforms.conf
[setnull]
REGEX=gmail.com
DEST_KEY=queue
FORMAT=nullQueue
[setparsing]
REGEX=yahoo.com
DEST_KEY=queue
FORMAT=indexQueue
SETNULL filter works well, but not SETPARSING one. I tried following -
1) changed order to setparsing,setnull in props.conf
restarted splunk after making changes
Any insights why INCLUDE filter is not working as expected ?
@to4kawa - Exactly I did the same thing as well.
REGEX works fine in SETNULL but not in SETPARSING.
[setnull]
REGEX= .
DEST_KEY=queue
FORMAT=nullQueue
[setparsing]
REGEX=yahoo.com
DEST_KEY=queue
FORMAT=indexQueue
If I put REGEX of SETPARSING in SETNULL , it works well - which indicates its not a REGEX issue too.
Any other insight ?
Okay, so you are creating a field called queue
that contains either the value nullQueue
, the value indexQueue
, or no value at all.
First, if any part of the record matches the REGEX gmail.com
(for instance gmailxcom
and gmail.com
match that regex) then the field will be assigned the value nullQueue
.
Then, if any part of the record matches the REGEX yahoo.com
(for instance yahoo9com
and yahoo.com
match that regex) then the field will be assigned or changed to the value indexQueue
.
If no part matches either, then the field queue
will not be created.
So, when you say it is not working, are you saying that events which have the value yahoo.com
in them are not being assigned a value for queue
?
And where and when are you validating that?