Setnull and Setparsing

[rashi83]

I am using SETNULL and SETPARSING to include and exclude log events. Here is the files -

Props.conf
[OktaIM2:log]
TRANSFORMS-set= setnull,setparsing

transforms.conf
[setnull]
REGEX=gmail.com
DEST_KEY=queue
FORMAT=nullQueue

[setparsing]
REGEX=yahoo.com
DEST_KEY=queue
FORMAT=indexQueue

SETNULL filter works well, but not SETPARSING one. I tried following -

1) changed order to setparsing,setnull in props.conf
restarted splunk after making changes

Any insights why INCLUDE filter is not working as expected ?

[to4kawa]

see
https://www.coursehero.com/file/p7nhp2hf/When-you-set-the-setnull-transform-first-it-matches-all-eve...

[rashi83]

@to4kawa - Exactly I did the same thing as well.

REGEX works fine in SETNULL but not in SETPARSING.
[setnull]
REGEX= .
DEST_KEY=queue
FORMAT=nullQueue

[setparsing]
REGEX=yahoo.com
DEST_KEY=queue
FORMAT=indexQueue

If I put REGEX of SETPARSING in SETNULL , it works well - which indicates its not a REGEX issue too.

Any other insight ?

[DalJeanis]

Okay, so you are creating a field called queue that contains either the value nullQueue, the value indexQueue, or no value at all.

First, if any part of the record matches the REGEX gmail.com (for instance gmailxcom and gmail.com match that regex) then the field will be assigned the value nullQueue.

Then, if any part of the record matches the REGEX yahoo.com (for instance yahoo9com and yahoo.com match that regex) then the field will be assigned or changed to the value indexQueue.

If no part matches either, then the field queue will not be created.

So, when you say it is not working, are you saying that events which have the value yahoo.com in them are not being assigned a value for queue?

And where and when are you validating that?