Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Running btool shows there are no system/local folders. How to edit props.conf and transforms.conf?

$
0
0
Troubleshooting a problem with trying to route events to nullQueue. Ran the btool props list --debug to see what was being applied and found that none of my "local" folders are listed. I thought those should have first precedence, but not showing up at all seems to explain why they aren't working... entries in the system\local files : props.conf [WinEventLog:Application] TRANSFORMS-null=setnull transforms.conf [setnull] REGEX=Sage\.SalesLogix\.Orm\.EntityBase DEST_KEY=queue FORMAT=nullQueue Any ideas why the local folders are not being applied?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>