I have a data source where I'm applying multiple transforms (because there are multiple possible formats for the log lines in the data source...sucky, but it's what I have to work with). Here's what I've set in props.conf: [error-test] BREAK_ONLY_BEFORE=^ MAX_TIMESTAMP_LOOKAHEAD=150 NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true TIME_FORMAT=[%A %B %d %T %Y] REPORT-error_logs=assignZkError, assignIPSPHP, assignSTD, assignBadScript, assignErrorOnly, assignRestartDigest, assignRestartStatus, assignDud This is working fantastically for extracting the fields defined in the regex values in each of those transforms stanzas. However, I want each transform stanza to assign a different sourcetype. That part is not working. When I use these settings, I get the stanza name from props.conf (i.e., "error-test"), not the sourcetype value specified in the transforms.conf. Here's my transforms.conf: [assignDud] REGEX = (?<error_message>.*) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::dud [assignRestartStatus] REGEX = \[(?<error_time>\w{3} \w{3} \d+ \d{2}:\d{2}:\d{2} \d{4})\] \[(?<error_type>\w+)\] (?<error_message>.*) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::restart [assignRestartDigest] REGEX = \[(?<error_time>\w{3} \w{3} \d+ \d{2}:\d{2}:\d{2} \d{4})\] \[(?<error_type>\w+)\] (?<error_class>[\w\s\d]+): (?<error_message>.*) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::restart [assignErrorOnly] REGEX = \[(?<error_time>\w{3} \w{3} \d+ \d{2}:\d{2}:\d{2} \d{4})\] \[(?<error_type>\w+)\] \[client (?<error_client>\d+\.\d+\.\d+\.\d+)\] (?<error_message>.*) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::error_only [assignBadScript] REGEX = \[(?<error_time>\w{3} \w{3} \d+ \d{2}:\d{2}:\d{2} \d{4})\] \[(?<error_type>\w+)\] \[client (?<error_client>\d+\.\d+\.\d+\.\d+)\] (?<error_message>.*)(, referer: (?<error_referrer>.*)) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::bad_script [assignSTD] REGEX = \[(?<error_time>\w{3} \w{3} \d+ \d{2}:\d{2}:\d{2} \d{4})\] \[(?<error_type>\w+)\] \[client (?<error_client>\d+\.\d+\.\d+\.\d+)\] (|\(\d+\))(?<error_class>[\w\s\d]+): (?<error_message>.*)(, referer: (?<error_referrer>.*)|\n) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::standard [assignIPSPHP] REGEX = \[(?<error_time>\w{3} \w{3} \d+ \d{2}:\d{2}:\d{2} \d{4})\] \[(?<error_type>\w+)\] \[client (?<error_client>\d+\.\d+\.\d+\.\d+)\] \[\w{3} \w{3} \d+ \d{2}:\d{2}:\d{2} \d{4}\] \[(?<error_class>IPS_PHP:\S+)\] \"(?<error_message>.*)\" URI: (?<error_uri>\S+) APACHE: (?<error_apache>\S+) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::IPS_PHP [assignZkError] REGEX = \[(?<error_time>\w{3} \w{3} \d+ \d{2}:\d{2}:\d{2} \d{4})\] \[(?<error_type>\w+)\] \[client (?<error_client>\d+\.\d+\.\d+\.\d+)\] \[\w{3} \w{3} \d+ \d{2}:\d{2}:\d{2} \d{4}\] \[(?<error_class>ZkError:\S+)\] \"(?<error_message>.*)\" URI: (?<error_uri>\S+) APACHE: (?<error_apache>\S+), referer: (?<error_referrer>.*) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::ZkError What am I doing wrong? EDIT: At present, I'm testing my configurations by importing a flat file once that contains examples of each of the types of errors that these transforms are being applied to, so this props.conf and transforms.conf exist on the Splunk server, not on the Universal Forwarder that will ultimately be sending the data. ... View more

I just set up a new forwarder on a new Linux server and set it to monitor some files. For some reason, it is sending the data to the indexer twice; I haven't been able to figure out why. Here's my inputs.conf : [monitor:/mnt/swift/accounts/*/logfiles/*Queued.log] ignoreOlderThan = 1d index = mta-logs_queued sourcetype = mta-logs_queued disabled = 0 [monitor:/mnt/swift/accounts/*/logfiles/*Deferred.log] ignoreOlderThan = 1d sourcetype = mta-logs_deferred index = mta-logs_deferred disabled = 0 [monitor:/mnt/swift/accounts/*/logfiles/*Processed.log] ignoreOlderThan = 1d sourcetype = mta-logs_processed index = mta-logs_processed disabled = 0 And my props.conf : [mta-logs_queued] INDEXED_EXTRACTIONS=csv NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false KV_MODE=none PREAMBLE_REGEX=# HEADER_FIELD_DELIMITER=, FIELD_NAMES=Date,Time,EventType,SystemMessageId,CustomMessageId,MailingID,To,From,Size TIMESTAMP_FIELDS=Date,Time TIME_FORMAT=%m/%d/%Y %H:%M:%S TZ=America/Chicago FIELD_DELIMITER=space [mta-logs_processed] INDEXED_EXTRACTIONS=csv NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false KV_MODE=none PREAMBLE_REGEX=# HEADER_FIELD_DELIMITER=, FIELD_NAMES=Date,Time,EventType,SystemMessageId,CustomMessageId,MailingID,To,From,Size,ConnectionId,Reason,Message,LocalIp,FailureCode TIMESTAMP_FIELDS=Date,Time TIME_FORMAT=%m/%d/%Y %H:%M:%S TZ=America/Chicago FIELD_DELIMITER=space [mta-logs_deferred] INDEXED_EXTRACTIONS=csv NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false KV_MODE=none PREAMBLE_REGEX=# HEADER_FIELD_DELIMITER=, FIELD_NAMES=Date,Time,EventType,SystemMessageId,CustomMessageId,MailingID,To/Domain,From,Size/Count,ConnectionId,Reason,LocalIP TIMESTAMP_FIELDS=Date,Time TIME_FORMAT=%m/%d/%Y %H:%M:%S TZ=America/Chicago FIELD_DELIMITER=space Sample raw data: #Software: SocketLabs, Inc. Hurricane Server. #Version: 1.0.0.917 #Date: 1/28/2015 00:00:08 #Account: 1000 #Fields: Date Time EventType SystemMessageId CustomMessageId MailingID To From Size 1/28/2015 15:08:02 Queued 6e000000199d02 - - recipient@domain.com sender@domain.com 464 #Software: SocketLabs, Inc. Hurricane Server. #Version: 1.0.0.917 #Date: 1/28/2015 00:00:09 #Account: 1000 #Fields: Date Time EventType SystemMessageId CustomMessageId MailingID To From Size ConnectionId Reason Message LocalIp FailureCode 1/28/2015 15:08:03 Sent 6e000000199d02 - - recipient@domain.com sender@domain.com 464 6e000000088f08 250+2.5.0+Ok - 10.110.76.77 - Sample expected event group: 1/28/2015 15:08:02 Queued 6e000000199d02 - - recipient@domain.com sender@domain.com 464 1/28/2015 15:08:03 Sent 6e000000199d02 - - recipient@domain.com sender@domain.com 464 6e000000088f08 250+2.5.0+Ok - 10.110.76.77 - Sample actual event group: 1/28/2015 15:08:02 Queued 6e000000199d02 - - recipient@domain.com sender@domain.com 464 1/28/2015 15:08:02 Queued 6e000000199d02 - - recipient@domain.com sender@domain.com 464 1/28/2015 15:08:03 Sent 6e000000199d02 - - recipient@domain.com sender@domain.com 464 6e000000088f08 250+2.5.0+Ok - 10.110.76.77 - 1/28/2015 15:08:03 Sent 6e000000199d02 - - recipient@domain.com sender@domain.com 464 6e000000088f08 250+2.5.0+Ok - 10.110.76.77 - From the splunkd.log : 01-28-2015 14:11:53.156 -0600 INFO TailingProcessor - Parsing configuration stanza: monitor:/mnt/swift/accounts/*/logfiles/*Deferred.log. 01-28-2015 14:11:53.156 -0600 INFO TailingProcessor - Parsing configuration stanza: monitor:/mnt/swift/accounts/*/logfiles/*Processed.log. 01-28-2015 14:11:53.156 -0600 INFO TailingProcessor - Parsing configuration stanza: monitor:/mnt/swift/accounts/*/logfiles/*Queued.log. 01-28-2015 14:11:53.156 -0600 INFO TailingProcessor - Adding watch on path: /mnt/swift/accounts. 01-28-2015 15:08:07.229 -0600 INFO WatchedFile - Resetting fd to re-extract header. 01-28-2015 15:08:07.233 -0600 INFO WatchedFile - Resetting fd to re-extract header. I also see some lines in this log, Checksum for seekptr didn't match, will re-read entire file='/mnt/swift/accounts/1034/logfiles/20150128Deferred.log'. (but the timestamps don't seem to line up the way the "Resetting fd" ones above do). This is 100% unrelated to the duplicated data. Something's wrong with that particular file. The inputs are not duplicated anywhere, they live ONLY in /opt/splunkforwarder/etc/system/local/inputs.conf on the forwarder. Ditto with props.conf . The duplication isn't instantaneous: the first copy of the events comes in, and a couple minutes later, the duplicates show up. This is the first time I've used the w3c extraction type, so maybe I've configured something wrong? I'm running Splunk 6.1.2, the forwarder is 6.0. ... View more