topic Re: transform.conf in Getting Data In

transform.conf

lorscardala985 — Wed, 19 Jul 2023 07:38:07 GMT

how can i modify the transforms.conf file so that when i ingest the data it throws away all the events that have the status FAILED after the first ip address

Re: transform.conf

ITWhisperer — Wed, 19 Jul 2023 07:55:15 GMT

You need to identify these events and direct them to a null queue

Re: transform.conf

lorscardala985 — Wed, 19 Jul 2023 07:59:14 GMT

how can i identify, because i have file with log events, and i need to ingest on splunk

Re: transform.conf

ITWhisperer — Wed, 19 Jul 2023 08:07:56 GMT

Essentially you need a regex to identify the events you want to filter (or route)

https://docs.splunk.com/Documentation/Splunk/9.1.0/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues