Getting Data In

Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

Communicator

I have set the following on transforms.conf and props.conf but I still see DEBUG logs in my search. what did I miss

transforms.conf

#Remove: DEBUG
[null_kube_DEBUG]
REGEX = (DEBUG)
DEST_KEY=queue
FORMAT=nullQueue

props.conf

#### kube ################################
[source::kube.var.log.containers.*]
TRANSFORMS-null = null_kube_DEBUG
0 Karma

Champion

Can you try to use in props.conf:

 [null_kube_DEBUG]
 REGEX = DEBUG
 DEST_KEY=queue
 FORMAT=nullQueue
0 Karma

Communicator

thanks for the response, but still not filtering DEBUG. is there any difference for the logs ingested via http even collector (HEC)? this issue only I got on the logs ingested via HEC, other logs ingested via UF I don't see this issue.

0 Karma

SplunkTrust
SplunkTrust

Did you restart the HF?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Communicator

yes I did 🙂

0 Karma

Revered Legend

This will only affect the new incoming messages (any already ingested data would still showup in the search results). What does you DEBUG event look like? Can share a sample or two?

0 Karma

Communicator
2018-04-20 20:36:35 DEBUG NetworkClient:627 - Initiating connection to node -1 at myserver1.net:9092.\n
2018-04-20 20:36:35 DEBUG NetworkClient:767 - Initialize connection to node -1 for sending metadata request\n
2018-04-20 20:36:35 DEBUG NetworkClient:570 - Node -3 disconnected.\n
2018-04-20 20:36:35 DEBUG NetworkClient:627 - Initiating connection to node -1 at myserver1.net:9092.\n
2018-04-20 20:36:35 DEBUG NetworkClient:767 - Initialize connection to node -1 for sending metadata request\n
2018-04-20 20:36:35 DEBUG NetworkClient:570 - Node -2 disconnected.\n
0 Karma

Communicator

this is newly ingested data.

0 Karma