Unable to configure "message" search index in Splunkforwarder

[subramanianers]

I have a splunk forwarder setup in my server to forward all my logs to Splunk. I could not find a default message field in Splunk search. I would like the log string to be part of a specific field - 'message'. So, I decided to configure it in the splunk forwarder settings as follows:

#/opt/splunkforwarder/etc/system/local/transforms.conf

[message-transform]
REGEX = *
FORMAT = message::"$1"
WRITE_META = true

#/opt/splunkforwarder/etc/system/local/props.conf

[host::*]
TRANSFORMS-message = message-transform

#/opt/splunkforwarder/etc/system/local/fields.conf

[message]
INDEXED=true

But even with this configuration, I am not seeing the message field in my Splunk search. Am I missing anything?

[scelikok]

Hi @subramanianers,

Is your "splunkforwarder" full instance?

transforms.conf and props.conf must be either on Heavy Forwarder or on Indexers.

fields.conf must be on your Search Head.

Please check if they are in correct places.

[richgalloway]

The REGEX setting is not a valid regular expression.  I believe you want REGEX = .*

These settings are about the same as the built-in field _raw.

[subramanianers]

It did not work @richgalloway. I understand that it is the same as _raw, but I want the log in "message" field. Is there some other configuration change that has to be made? 

[richgalloway]

Another option is REGEX = [\s\S]+

Or change the source to produce a message field.

Or add FIELDALIAS-message = _raw asnew message to props.conf.