I have the following props & transforms in splunk dev and prod environment monitoring the same set of iis logs:
#props.conf
[source::/home/luan/logs/someiislog2*]
CHECK_FOR_HEADER=false
TZ = UTC
pulldown_type = true
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = false
EXTRACT-SiteID = (?<siteid>W3SVC\d+) in source
REPORT-iisFields= iis-c
SEDCMD-001TrimWhiteSpace = s/(\s)\s+/\1/g
SEDCMD-002RemoveCookie = s/(.*\s\d{1,}\.\d{1,}\.\d{1,}\.\d{1,})\s\S+\s(\S+\s.*)/\1 - \2/g
TRANSFORMS-ToIisSourceType = forcetoIISsourcetype
trsnsforms.conf
[iis-c]
DELIMS = " "
FIELDS = date, time, cs_method, cs_uri_stem, cs_uri_query, c_ip, cs_Cookie, cs_Referer, cs_host, sc_status, sc_bytes, time_taken
[forcetoIISsourcetype]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::iis
Everything works in dev, but in prod, none of the index-time stuff (SEDCMD and TRANSFORMS-ToIisSourceType ) appear to be working. I have checked the splunkd.log but did not find any relevant message.
How can I further troubleshoot this issue? Which debug parameters can I enable to gather more information?