Getting Data In

Why are my props and transforms.conf not filtering data on the heavy forwarder?

prakash007
Builder

I have a Heavy Forwarder installed which sends the logs to Splunk Cloud. Here's the workflow, please shed some light on this....
UFs-----> HWF ----->Splunk clould indexers

-data is flowing into the cloud and searchable, but when I tried to place some filtering on the HWF using props.conf and transforms.conf, it's not filtering.
-I want to drop the events which contain keyword POST...

Here're the configs I have used...

HWF=========
outputs.conf

indexAndFoward = false (not sure if I have to make it true for filtering and i don't want to index data locally/ filtering didn't work though even when it's true)

props.conf

[source::/path/to/my/apache/logs/access*.log]    or  I also tried with sourcetype in here [apache_access]
TRANSFORMS-null = filter_diagnose, filter_scalars

transforms.conf

[filter_diagnose]
REGEX =`\"POST\s\/.*diagnoseMonitor`
DEST_KEY = queue
FORMAT = nullQueue

[filter_scalar]
REGEX = `\"POST\`s\/.*`Scalar.html
DEST_KEY = queue
FORMAT = nullQueue

=====================================================================
I have also tried this way using key words to filter.

props.conf

[source::/path/to/my/apache/logs/access*.log]    or  I also tried with sourcetype in here [apache_access]
TRANSFORMS-set= setnull, setparsing

transforms.conf

[setnull]
REGEX = POST
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mcnamara,

most likely the class names for TRANSFORMS- in props.conf are not unique; from the docs http://docs.splunk.com/Documentation/Splunk/6.3.1511/Admin/Propsconf :

TRANSFORMS-<class> = <transform_stanza_name>, <transform_stanza_name2>,...
* <class> is a unique literal string that identifies the namespace of the field you're extracting.

Try to change the set and null class to some longer stings like SetNullQueueForTheSourceFooBecauseWeDontNeedThem

Hope this helps ...

cheers, MuS

PS: remember to restart Splunk after the changes and also remember it will only apply to new events coming in.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...