Getting Data In

Why is my Splunk 6.2.5 Heavy Forwarder not filtering out events as expected?

Path Finder

My Heavy Forwarder forwards data to the indexer fine, however, I wanted to filter out some events before being forwarded using props.conf and transforms.conf, but the indexer still receives everything.

props.conf:

   [source::/var/log/vsftpd.log]
   TRANSFORMS-null = setnull

transforms.conf:

   [setnull]
   REGEX = 220
   DEST_KEY = queue
   FORMAT = nullQueue

for testing, I just simplified the REGEX to filter out all events containing "220"
I even tried REGEX = . (to filter out everything) but still had no effect.

What am I missing?
I'm using Splunk 6.2.5 BTW.

0 Karma
1 Solution

Path Finder

Mystery solved!

per Splunk support recommendation, i reinstalled a fresh splunk 6.2.5 and everything worked as expected.

I guess the problem is that my previous 6.2.5 installation was an upgrade from 6.0.1
Shouldn't have to do that but hey it works now.

View solution in original post

0 Karma

Path Finder

Mystery solved!

per Splunk support recommendation, i reinstalled a fresh splunk 6.2.5 and everything worked as expected.

I guess the problem is that my previous 6.2.5 installation was an upgrade from 6.0.1
Shouldn't have to do that but hey it works now.

View solution in original post

0 Karma

Path Finder

just open a new case with splunk support.
will post the results when the case is resolved.

0 Karma

SplunkTrust
SplunkTrust

Try like this (changes to transforms.conf, keep the same props.conf)

transforms.conf

[setnull]
REGEX = (220)
DEST_KEY = queue
FORMAT = nullQueue

Also, ensure to restart the heavy forwarder after change.

0 Karma

Path Finder

same results.
just for testing, i brought the props.conf/transforms.conf to the indexer and it filtered as expected.
so it must be something on the forwarder side.

not sure if it helps, but the "cmd btool" dumped this info:

% /opt/splunk/bin/splunk cmd btool transforms list setnull
[setnull]
CANOPTIMIZE = True
CLEAN
KEYS = True
DEFAULTVALUE =
DEST
KEY = queue
FORMAT = nullQueue
KEEPEMPTYVALS = False
LOOKAHEAD = 4096
MVADD = False
REGEX = 220
SOURCE
KEY = raw
WRITE
META = False

0 Karma