Splunk Heavy Forwarder Transforms

[ferdousfahim]

Hi, 

I have a Splunk Heavy Forwarder routing data to a Splunk Indexer. I also have a search head configured that performs distributed search on my indexer.

My Heavy forwarder has a forwarding license, so it does not index the data. However, I still want to use props.conf and transforms.conf on my forwarder. These configs are:

===============================================================

transforms.conf
[extract_syslog_fields]
DELIMS = "|"
FIELDS = "datetime", "syslog_level", "syslog_source", "syslog_message"
===============================================================
props.conf
[router_syslog]
TIME_FORMAT = %a %b %d %H:%M:%S %Y
MAX_TIMESTAMP_LOOKAHEAD = 24
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TRUNCATE = 10000
TRANSFORMS-extracted_fields = extract_syslog_fields

So what I expected is that when I search the index on my search head, I would see the fields  "datetime", "syslog_level", "syslog_source", "syslog_message" . However, this does not occur. On the otherhand, if I configure field extractions on the search-head, this works just fine and my syslog data is split up into those fields.

Am I misunderstanding how Transforms work ? Is the heavy forwarder incapable of splitting up my syslog into different fields based on a delimiter because it's not indexing the data ? 


Any help or advice would be highly appreciated. Thank you so much!

[gcusello]

Hi @ferdousfahim ,

I usually use this transformations at search time, but to apply them on Forwarders, you have to use INDEXED_EXTRACTIONS=CSV in props.conf, for more infos see at https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Extractfieldsfromfileswithstructureddata

Ciao.

Giuseppe