Splunk Search

I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?

Contributor

I have disabled the transform stanza in the GUI, but the regex field extractions are still effective. What's wrong?

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Createandmaintainsearch-timefieldextractio...

[<spec>]
REPORT-<class> = <uniquetransformstanzaname1>, <uniquetransformstanzaname2>,...

props.conf:REPORT-apNameList = apNameList
transforms.conf:[apNameList]
transforms.conf:disabled = 1

0 Karma

Esteemed Legend

There are things that create fields automatically; you should make sure that you set KV_MODE = none also. Post an example event and the fields that shouldn't be there.

0 Karma

Path Finder

You can check your eventually combined transforms.conf by executing the command.
splunk cmd btool transforms list.
Then you can check which transforms are active or not.

0 Karma

Contributor

I do not see any disabled argument in stanza's of transforms.conf

Just try commenting out the configuration and restart the instance.

Let me know how it goes... 🙂

Contributor

GUI problem?

0 Karma

Contributor

What do you mean by GUI problem?

0 Karma

Contributor

I navigated to Fields » Field transformations. Then I clicked disable in that row. Has the GUI produced "disabled = 1" which is undefined in transforms.conf.spec?

0 Karma

Contributor

Okay did you restart the instance??

0 Karma

Contributor

I did not restart the instance. After disabling the transform stanza thru the GUI, I hit http://localhost:8000/debug/refresh.

0 Karma

Contributor

Try this http://yoursplunkserver:8000/en-us/debug/refresh?entity=admin/transforms-lookup

Or if not please try a restart that should fix the issue.

0 Karma

Contributor

I tried all 3. The regex transform is still working. What is the "disabled = 1" in transforms.conf for? Why is the GUI for disabling transform stanzas there?

0 Karma