topic Re: splunk 6 forwarder headers? in Deployment Architecture

splunk 6 forwarder headers?

a212830 — Wed, 05 Feb 2014 16:20:40 GMT

Hi,

I seem to recall hearing about some new features in Splunk 6, where we can define "headers" that should be ignored by the forwarder. Am I imagining things? I can't find any doc that might show those features.

Re: splunk 6 forwarder headers?

alacercogitatus — Wed, 05 Feb 2014 17:08:15 GMT

Can you define "headers"? What OS? What log sources?

Re: splunk 6 forwarder headers?

a212830 — Thu, 06 Feb 2014 15:51:22 GMT

looking for examples on using the preamble_regex. Can I specify a start section/end section?

For example:

Line 1 preamble...
junk
more junk
even more junk
end of preamble

Is there a way to filter all that out?

Re: splunk 6 forwarder headers?

alacercogitatus — Thu, 06 Feb 2014 15:59:20 GMT

As long as your junk matches a PREAMBLE_REGEX setting, it should be filtered out.

For example, IIS might have this:

PREAMBLE_REGEX = ^#

Re: splunk 6 forwarder headers?

a212830 — Tue, 11 Feb 2014 11:58:04 GMT

Thanks. Do I need to enter regex for each line (which stinks), or is there a way to signify the start of the preamble and the end of the preamble?

Re: splunk 6 forwarder headers?

alacercogitatus — Tue, 11 Feb 2014 13:36:57 GMT

Any line that starts with "#" will be removed. I don't think it knows about "start" and "end" of a preamble.

Re: splunk 6 forwarder headers?

a212830 — Thu, 13 Feb 2014 01:56:41 GMT

Thanks. I was hoping it worked similar to some awk functions, where you could identify the start of a section and the end of a section.