topic Re: How to Ingest Splunk Lines starting with in Getting Data In

How to Ingest Splunk Lines starting with

whitefang1726 — Mon, 07 Feb 2022 08:00:40 GMT

Hello, how can I ingest logs starting with a specific word:

Sample Log Entry:
SPLUNKD-123456: Hello World
Hello World123
Hello World456
Hello World789
SPLUNKD-0000: Hello World
SPLUNKD-0012: Hello World
Hello World0123
Hello World0456

Logs that will be ingested into Splunk:

SPLUNKD-123456: Hello World
SPLUNKD-0000: Hello World
SPLUNKD-0012: Hello World

Thanks!

Re: How to Ingest Splunk Lines starting with

gcusello — Mon, 07 Feb 2022 08:16:30 GMT

Hi @whitefang1726,

let me understand: do you want to filter log before indexing and index only a subseto of events or do you want to index alla events and display in search only filtered events?

If you want to take only events that start with "SLUNKD" , you should see at https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues and put in your indexers or (if present) in your Heavy Forwarders the following conf files:

in props.conf:

[your_sourcetype] TRANSFORMS-set= setnull,setparsing

in transforms.conf:

[setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = ^SPLUNKD DEST_KEY = queue FORMAT = indexQueue

In the second case, you index all events and in your search you could run something liker this:

index=your_index sourcetype=your_sourcetype SPLUNKD | ...

Ciao.

Giuseppe

Re: How to Ingest Splunk Lines starting with

PickleRick — Mon, 07 Feb 2022 10:41:00 GMT

Filtering on ingest is one way (relatively universal but adding load to your indexers/heavy forwarders). You can also try to prevent the entries from being picked up by the input but how to do that is highly dependent on where you have your events and how you are receiving/pulling them.