props and transforms not working

[blbr123]

Hi All,

My props and transforms is not working.

Kept the props and transforms in the Heavy Forwarder.

can anyone please assist.

I want to drop the below lines from ingesting into Splunk but its not working.

#Date: 2024-05-03 00:00:01

#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken https

props:

[mysourcetype]
TRANSFORMS-drop_header= drop_header

Transforms:

[drop_header]

REGEX = ^#Date.+\n#Fields.+
DEST_KEY = queue
FORMAT = nullQueue

[PickleRick]

This format looks suspiciously familiar. Check if you're using INDEXED_EXTRACTIONS on this sourcetype. If you do, the data is parsed on the UF and is not further processed on the indexer (or HF).

[blbr123]

Yes I have checked in regex looks good.

There are no other HF's before.

[gcusello]

Hi @blbr123,

this seems to be a multiline og, try adding (?ms) at the beginning of the regex.

Then test your regex in Splunk not outside Splunk.

Ciao.

Giuseppe

[blbr123]

sure will give a try and what does (?ms) do?

[gcusello]

Hi @blbr123 ,

(?ms) in a regex means that you have to consider a multiine event.

Ciao.

Giuseppe

[blbr123]

Tested in splunk , only when I add (?ms) in front of regex it matches.

But when I check this entire regex in the regex tool it does not match

(?ms)^#Date.+\n#Fields.+

and I am not sure if we add (?ms) in transforms will work or not?

[gcusello]

Hi @blbr123 ,

test it in Splunk using the regex command.

Ciao.

Giuseppe

[gcusello]

Hi @blbr123,

did you checked the regex in Splunk?

If you could share some sample of your logs I can help you in this.

are there other (one or more) HFs before the one where you located props and transforms?

The transofrmation muste be applied in the first full Splunk instance where data pass through.

Ciao.

Giuseppe