https://community.splunk.com/t5/Getting-Data-In/Do-not-index-some-events-from-a-log-source/m-p/81781#M16875 <P>Look for the section titled: Discard specific events and keep the rest on this link <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad">RouteAndFilterData</A></P> <P>You'll just need to create a regex that matches those 2 log entries. The data will still be read and sent from a UF to the indexer, but the indexer will simply discard the messages.</P> <P>Something similar to the following<BR /> props.conf on your indexer:<BR /> [your_sourcetype]<BR /> TRANSFORMS-null= discard</P> <P>transforms.conf on your indexer:<BR /> [setnull]<BR /> REGEX = "=+\s(?:JOB COUNTERS|JOB COUNTERS END)\s=+"<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> <P>Might need to tweak the regex a bit, but that should work.</P> Wed, 29 Feb 2012 19:42:23 GMT mikelanghorst 2012-02-29T19:42:23Z https://community.splunk.com/t5/Getting-Data-In/Do-not-index-some-events-from-a-log-source/m-p/81780#M16874 <P>Hi,</P> <P>I have a log source that is causing some problems. I think it is caused by events like this ones:</P> <PRE><CODE>29-02-2012 18:00:58 UTC udb_persona_ingest INFO - ========= JOB COUNTERS ======== 29-02-2012 18:00:58 UTC udb_persona_ingest INFO - ========= JOB COUNTERS END ======== </CODE></PRE> <P>how can I configure splunk to not index this particular event that is linked to a sourcetype.</P> <P>Thanks in advanced.<BR /> Lp</P> Wed, 29 Feb 2012 19:36:49 GMT https://community.splunk.com/t5/Getting-Data-In/Do-not-index-some-events-from-a-log-source/m-p/81780#M16874 lpolo 2012-02-29T19:36:49Z https://community.splunk.com/t5/Getting-Data-In/Do-not-index-some-events-from-a-log-source/m-p/81781#M16875 <P>Look for the section titled: Discard specific events and keep the rest on this link <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad">RouteAndFilterData</A></P> <P>You'll just need to create a regex that matches those 2 log entries. The data will still be read and sent from a UF to the indexer, but the indexer will simply discard the messages.</P> <P>Something similar to the following<BR /> props.conf on your indexer:<BR /> [your_sourcetype]<BR /> TRANSFORMS-null= discard</P> <P>transforms.conf on your indexer:<BR /> [setnull]<BR /> REGEX = "=+\s(?:JOB COUNTERS|JOB COUNTERS END)\s=+"<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> <P>Might need to tweak the regex a bit, but that should work.</P> Wed, 29 Feb 2012 19:42:23 GMT https://community.splunk.com/t5/Getting-Data-In/Do-not-index-some-events-from-a-log-source/m-p/81781#M16875 mikelanghorst 2012-02-29T19:42:23Z https://community.splunk.com/t5/Getting-Data-In/Do-not-index-some-events-from-a-log-source/m-p/81782#M16876 <P>Thanks I will test it tomorrow.</P> Wed, 29 Feb 2012 20:11:01 GMT https://community.splunk.com/t5/Getting-Data-In/Do-not-index-some-events-from-a-log-source/m-p/81782#M16876 lpolo 2012-02-29T20:11:01Z