Getting Data In

What are the sequence of execution transforms across different stanza and locations?

fxyfrank_acn
Explorer

Hi,

We want to change sourcetype and then send data to two different Splunk Indexers.

What is happening is the sourcetype is getting changed (that means first props.conf stanza is working) BUT the seconds props.conf stanza present in the apps folder is not working (It is only sending the logs to default output group).

Configuration files for change sourcetypes are located in the /system/local folder and route data configuration files are in the /apps/application/local/ folder.

Does anyone have similar issue? Thanks!

SPLUNK_HOME/etc/system/local/

props.conf

[source::/abc/xyz.log]
TRANSFORMS-changesourcetype = st

transforms.conf

[st]
REGEX = \.*\[12345]\.*
FORMAT = sourcetype::sourcetype1
DEST_KEY = MetaData:Sourcetype

SPLUNK_HOME/etc/apps/application/local

props.conf

[sourcetype1]
TRANSFORMS-routing = route_data

transforms.conf

[route_data]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer1, indexer2
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

The sourcetype is only checked once as the event enters the pipeline. So change your routing to be for [source::/abc/xyz.log] instead

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

The sourcetype is only checked once as the event enters the pipeline. So change your routing to be for [source::/abc/xyz.log] instead

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...