topic Re: Send the data to nullqueue except matching event in Getting Data In

Send the data to nullqueue except matching event

RSS_STT — Thu, 06 Mar 2025 15:24:30 GMT

I want to send the all the event to nullqueue except having match "EventType": 5000.

{"EventID": 2154635, "EventType": 5000, "NetObjectValue": null, "EngineID": null}

[solarwinds:alerts]
TRANSFORMS-t=eliminate-except-5000

[eliminate-except-5000]
REGEX=[\w\W]+[^("EventType": 500)]
DEST_KEY=queue
FORMAT=nullQueue

Re: Send the data to nullqueue except matching event

richgalloway — Thu, 06 Mar 2025 15:51:32 GMT

Regular expressions don't handle negation well. The given regex will match the sample event because the third character does not consist of "EventType". It's probably better to index matching events and discard the rest.

[solarwinds:alerts] TRANSFORMS-t=keep-5000, delete-others [keep-5000] REGEX = ("EventType": 5000) DEST_KEY = queue FORMAT = indexQueue [delete-others] REGEX = . DEST_KEY = queue FORMAT = nullQueue

Re: Send the data to nullqueue except matching event

livehybrid — Thu, 06 Mar 2025 22:46:07 GMT

@richgalloway

Just a thought, but arent the transforms applied in order, so with keep-5000, delete-others it will set indexQueue if its eventType 5000, and then set nullQueue for everything (incl eventType 5000)? I think the queue can be updated multiple times with props/transforms so might need to be delete-others first so it set queue to nullQueue for everything, and then update to indexQueue for eventType 5000?

I might be wrong and cant find any solid evidence to backup my theory at the mo, other than trying it out which I will do if I get chance!

Re: Send the data to nullqueue except matching event

isoutamo — Thu, 06 Mar 2025 23:37:51 GMT

You @livehybrid are correct. It should be 1st send all to nullQueue and then select those events which you want to keep.

Re: Send the data to nullqueue except matching event

richgalloway — Fri, 07 Mar 2025 00:57:51 GMT

You're right, @livehybrid I have the order reversed. Here's the docs I couldn't find earlier: https://docs.splunk.com/Documentation/Splunk/9.4.1/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest

Re: Send the data to nullqueue except matching event

PickleRick — Fri, 07 Mar 2025 13:23:45 GMT

Yes. The transforms are applied

1. Within a single transform class - left to right

2. Separate transform classes are called in alphabetical order.

What is important though (and what is often overlooked by the beginners; guilty of it myself 😉) is that all matching transforms are "fired". It's not like ACL that only first one that matches is executed.

So if you want to do something only for some events, you have to _first_ do the default action (for example, redirect to nullQueue as in this example) and only _then_ update some events to get the special treatment (in this case - get them indexed).