Getting Data In

Transform to replace index does not work for two hosts

echalex
Builder

Due to certain reasons, we have a number of destination indexes that need to be rewritten before indexing. Basically a partner of ours is using the name fubar_company, while we use another. We have a number of rules in transforms.conf to rewrite. The failing example is below. The others are very similar.

This works for the entire infrastructure, except two Splunk servers, one search head and one cluster master. Both of them forward to the indexer cluster, with indexAndForward = false.

For a while, we received alerts for events being forwarded to a non-existing index. So I created the index and can see the events in index=os from both hosts. The splunk_server field reveals that the events end up in the correct indexers, but not index.

We're using Splunk 6.2.1. The files are distributed to the indexers through the cluster master.

props.conf:
[default]
TRANSFORMS-changeindex=redirIdxLinux # There are more transforms here, but this is the failing one

transforms.conf:
[redirIdxLinux]
REGEX = linux_company
SOURCE_KEY = _MetaData:Index
DEST_KEY = _MetaData:Index
FORMAT = os
Tags (1)
0 Karma
1 Solution

maciep
Champion

do you have those setting pushed to your search head and cm as well? I believe that parsing will happen at the first full Splunk Enterprise instance along the way, which would be the servers themselves.

View solution in original post

maciep
Champion

do you have those setting pushed to your search head and cm as well? I believe that parsing will happen at the first full Splunk Enterprise instance along the way, which would be the servers themselves.

echalex
Builder

Yep, you're quite right. Actually, the thought occurred to me, so I copied the files to the relevant servers and did an |extract reload=T as per the documentation. However, it seems this doesn't take effect without a full restart. It works as expected after a restart.
Thanks!

jluo_splunk
Splunk Employee
Splunk Employee

I believe the "|extract reload=T" was deprecated. Do you have admin capabilities on your splunk servers? You can go to :/debug/refresh to reload the transforms and props without a full restart.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...