I have disabled the transform stanza in the GUI, but the regex field extractions are still effective. What's wrong?
[<spec>]
REPORT-<class> = <unique_transform_stanza_name1>, <unique_transform_stanza_name2>,...
props.conf:REPORT-apNameList = apNameList
transforms.conf:[apNameList]
transforms.conf:disabled = 1
There are things that create fields automatically; you should make sure that you set KV_MODE = none
also. Post an example event and the fields that shouldn't be there.
You can check your eventually combined transforms.conf by executing the command.
splunk cmd btool transforms list.
Then you can check which transforms are active or not.
I do not see any disabled argument in stanza's of transforms.conf
Just try commenting out the configuration and restart the instance.
Let me know how it goes... 🙂
GUI problem?
What do you mean by GUI problem?
I navigated to Fields » Field transformations. Then I clicked disable in that row. Has the GUI produced "disabled = 1" which is undefined in transforms.conf.spec?
Okay did you restart the instance??
I did not restart the instance. After disabling the transform stanza thru the GUI, I hit http://localhost:8000/debug/refresh.
Try this http://yoursplunkserver:8000/en-us/debug/refresh?entity=admin/transforms-lookup
Or if not please try a restart that should fix the issue.
I tried all 3. The regex transform is still working. What is the "disabled = 1" in transforms.conf for? Why is the GUI for disabling transform stanzas there?