Can we use same property names (say "[setnull]","[setparsing]") defining the event data filtering criteria , in two different apps (having different filtering criteria) residing on same server ?

[jincy_18]

I have two clustered environments consisting of 3 SH,3 Indexers and 1 HWF each running on Splunk 6.4.1.I need to filter out certain unwanted events coming from jms queues and send them to the nullQueue.

We have two applications running on same servers, having different criteria for filtering event data.

I added below code in HWF in props.conf for one of the apps:

 [my_sourcetype]
 TRANSFORMS-set= setnull,setparsing

and this in transforms.conf

 [setnull]
 REGEX = .
 DEST_KEY = queue
 FORMAT = nullQueue

 [setparsing]
 REGEX = (?<=mbody=.{51}TQ-123|mbody=.{51}TQ-145)
 DEST_KEY = queue
 FORMAT = indexQueue

Can I use the same names property name i.e., "setnull" , "setparsing" in transforms.conf of the other app and define a new regex there? Will doing so have any impact on filtering?

[meenal901 · Accepted solution]

Hi jincy_18,

No, you should not use the same stanza name even if apps are different. Splunk will not throw any error but as you might already know, your stanza settings will get merged based on priority of Configuration File Precedence which might lead to incorrect filtering. Check this for details:

http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles

[jincy_18]

Thank you meenal, I changed the names and it works perfectly fine.