I've got a multi-character delimited file, which looks something like this:
"27-MAY-16 04.25.26.746000 AM"|;|""|;|"Session"|;|"0"|;|""|;|"lkjsdf;lkjbxsadf;lkjwta4"|;|"0"|;|""|;|""|;|""|;|"server_type"|;|"Server"|;|"1234"|;|"-"|;|"255.255.255.255"|;|""|;|"HTTP_PolicyName"|;|""|;|""|;|"HTTP_Gateway"|;|""|;|""|;|""|;|""|;|""|;|""|;|"HTTP_PolicyName:1"|;|""|;|"Policy Description"|;|""|;|"Web Gateway"|;|"8612712380412232330"|;|""|;|""|;|"Scheme"|;|""|;|""|;|""|;|""|;|""|;|""|;|""|;|""|;|""|;|""|;|""|;|""|;|""|;|""|;|""||?--END---?||"
I have a standalone installation of Splunk Enterprise for dev purposes and I created my props/transforms for this log file and got it working just fine. However, when I deploy it across my cluster and attempt to index these files in prod, I am not getting any field extractions.
props.conf
[oracle]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
PREAMBLE_REGEX = 1
SHOULD_LINEMERGE = false
SEDCMD-01_change_delims_in_oracle_logs = s/\|;\|/,/g
REPORT-set_delimiters_oracle_logs = 01_delims_oracle_logs
transforms.conf
[01_delims_oracle_logs]
DELIMS = ","
FIELDS= Field1,Field2,Field3...
I have these deployed to the forwarder, Indexer cluster through a cluster-bundle, and even on the Search Head. SEDCMD runs just fine to replace the given delims to commas:
"27-MAY-16 04.25.26.746000 AM","","Session","0","","lkjsdf;lkjbxsadf;lkjwta4","0","","","","server_type","Server","1234","-","255.255.255.255","","HTTP_PolicyName","","","HTTP_Gateway","","","","","","","HTTP_PolicyName:1","","Policy Description","","Web Gateway","8612712380412232330","","","Scheme","","","","","","","","","","","","","","",""||?--END---?||"
But absolutely no fields that I specify in transforms.conf are searchable. How should I spread these props/transforms across my environment? It works great in a standalone instance, just not when applied to a forwarder/cluster/standalone search head combo. I've tried disabling all of the props on the forwarder side and just leaving them on the Indexers, but that didn't change anything.
↧