Splunk Search

Can we use same property names (say "[setnull]","[setparsing]") defining the event data filtering criteria , in two different apps (having different filtering criteria) residing on same server ?

jincy_18
Path Finder

I have two clustered environments consisting of 3 SH,3 Indexers and 1 HWF each running on Splunk 6.4.1.I need to filter out certain unwanted events coming from jms queues and send them to the nullQueue.

We have two applications running on same servers, having different criteria for filtering event data.

I added below code in HWF in props.conf for one of the apps:

 [my_sourcetype]
 TRANSFORMS-set= setnull,setparsing

and this in transforms.conf

 [setnull]
 REGEX = .
 DEST_KEY = queue
 FORMAT = nullQueue

 [setparsing]
 REGEX = (?<=mbody=.{51}TQ-123|mbody=.{51}TQ-145)
 DEST_KEY = queue
 FORMAT = indexQueue

Can I use the same names property name i.e., "setnull" , "setparsing" in transforms.conf of the other app and define a new regex there? Will doing so have any impact on filtering?

0 Karma
1 Solution

meenal901
Communicator

Hi jincy_18,

No, you should not use the same stanza name even if apps are different. Splunk will not throw any error but as you might already know, your stanza settings will get merged based on priority of Configuration File Precedence which might lead to incorrect filtering. Check this for details:

http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles

View solution in original post

0 Karma

meenal901
Communicator

Hi jincy_18,

No, you should not use the same stanza name even if apps are different. Splunk will not throw any error but as you might already know, your stanza settings will get merged based on priority of Configuration File Precedence which might lead to incorrect filtering. Check this for details:

http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles

View solution in original post

0 Karma

jincy_18
Path Finder

Thank you meenal, I changed the names and it works perfectly fine.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!