Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Index time props and transforms not working

$
0
0

I have the following props & transforms in splunk dev and prod environment monitoring the same set of iis logs:


#props.conf
[source::/home/luan/logs/someiislog2*]
CHECK_FOR_HEADER=false
TZ = UTC
pulldown_type   = true
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE    = false
EXTRACT-SiteID = (?<siteid>W3SVC\d+) in source
REPORT-iisFields= iis-c

SEDCMD-001TrimWhiteSpace    = s/(\s)\s+/\1/g
SEDCMD-002RemoveCookie      = s/(.*\s\d{1,}\.\d{1,}\.\d{1,}\.\d{1,})\s\S+\s(\S+\s.*)/\1 - \2/g
TRANSFORMS-ToIisSourceType = forcetoIISsourcetype

trsnsforms.conf

[iis-c]
DELIMS = " "
FIELDS = date, time, cs_method, cs_uri_stem, cs_uri_query, c_ip, cs_Cookie, cs_Referer, cs_host, sc_status, sc_bytes, time_taken

[forcetoIISsourcetype]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::iis

Everything works in dev, but in prod, none of the index-time stuff (SEDCMD and TRANSFORMS-ToIisSourceType ) appear to be working. I have checked the splunkd.log but did not find any relevant message.

How can I further troubleshoot this issue? Which debug parameters can I enable to gather more information?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>