Getting Data In

What are the execution sequence of transforms from different stanza located in the difference configuration files ?

fxyfrank_acn
Explorer

We want to change sourcetype and then send data to two different Splunk Indexers.

What is happening is the sourcetype is getting changed (that means first transform is working) BUT the seconds pros.conf stanza present in the apps folder is not working (It is only send the logs to default output group).

Transform 1: SPLUNK_HOME/etc/system/local/
props.conf

[source::/abc/xyz.log]
TRANSFORMS-changesourcetype = st

transforms.conf

[st]
REGEX = \.*\[12345]\.*
FORMAT = sourcetype::my_sourcetype
DEST_KEY = MetaData:Sourcetype

Transform 2: SPLUNK_HOME/etc/apps/application/local/
props.conf

[my_sourcetype]
TRANSFORMS-routing = route_data

transforms.conf

[route_data]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer1, indexer2
Tags (1)

anwarmian
Communicator

Since this will be performed at index parsing stage file precedence will be in global context so /system/local will have higher precedence than application/local.  So, in your case "my_sourcetype" will be created first then you can use "my_sourcetype" in application/local to redirect logs to different indexes.

 

0 Karma

harsmarvania57
Ultra Champion

Have a look at my answer https://answers.splunk.com/answers/686241/metadata-transforms-not-being-applied-after-series-1.html , you will get an idea what is happening.

0 Karma

vishaltaneja070
Motivator

Hello @fxyfrank_acn
Can you please share the details present in outputs.conf as well.

0 Karma

vishaltaneja070
Motivator

You have to mention something like this in outputs.conf as well to make second transforms work:

[tcpout:indexer1]
disabled=false
server=xx.x.xx.x:9997

[tcpout:indexer2]
disabled=false
server=xx.x.xx.x:9997
0 Karma

fxyfrank_acn
Explorer

the two indexers are specified in the outputs.conf as what you have mentioned however it still doesn't work.

I have tried to apply the Sourcetype change on the Indexer (indexing time), still no luck.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@fxyfrank_acn

Please see How Splunk determines precedence order and other section for your answer.

https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Wheretofindtheconfigurationfiles

You can run btool to see all the configuration values in use by your Splunk instance.

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

Thanks

0 Karma

MuS
Legend

And there is the common misunderstanding:

btool does not show the actual config in use by Splunk, it merges all on disk config files and shows the potential configuration Splunk is using ....

Quote from the docs:

Btool displays merged on-disk configurations. That is, btool shows you the merged settings in the .conf files. It does not necessarily show you what Splunk software is currently using.

link to the docs https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurat...

If you want to see the actual config Splunk is using right now, run this command:

$SPLUNK_HOME/bin/splunk show config ....

links to the docs https://docs.splunk.com/Documentation/Splunk/latest/Admin/CLIadmincommands

It is a bit like in the old days with Cisco routers, there is a difference between running config and start-up config 😉

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...