Transform to replace index does not work for two hosts

[echalex]

Due to certain reasons, we have a number of destination indexes that need to be rewritten before indexing. Basically a partner of ours is using the name fubar_company, while we use another. We have a number of rules in transforms.conf to rewrite. The failing example is below. The others are very similar.

This works for the entire infrastructure, except two Splunk servers, one search head and one cluster master. Both of them forward to the indexer cluster, with indexAndForward = false.

For a while, we received alerts for events being forwarded to a non-existing index. So I created the index and can see the events in index=os from both hosts. The splunk_server field reveals that the events end up in the correct indexers, but not index.

We're using Splunk 6.2.1. The files are distributed to the indexers through the cluster master.

props.conf:
[default]
TRANSFORMS-changeindex=redirIdxLinux # There are more transforms here, but this is the failing one

transforms.conf:
[redirIdxLinux]
REGEX = linux_company
SOURCE_KEY = _MetaData:Index
DEST_KEY = _MetaData:Index
FORMAT = os

[maciep · Accepted solution]

do you have those setting pushed to your search head and cm as well? I believe that parsing will happen at the first full Splunk Enterprise instance along the way, which would be the servers themselves.

[echalex]

Yep, you're quite right. Actually, the thought occurred to me, so I copied the files to the relevant servers and did an |extract reload=T as per the documentation. However, it seems this doesn't take effect without a full restart. It works as expected after a restart.
Thanks!

[jluo_splunk]

I believe the "|extract reload=T" was deprecated. Do you have admin capabilities on your splunk servers? You can go to :/debug/refresh to reload the transforms and props without a full restart.