topic Re: processing only certain hosts from a file in Getting Data In

processing only certain hosts from a file

a212830 — Thu, 31 Jan 2013 11:09:31 GMT

Hi,

I have a logfile with a bunch of hosts, but I only want to index certain hosts and throw the rest away. How would I do this?

Ayn — Thu, 31 Jan 2013 11:15:02 GMT

a212830 — Thu, 31 Jan 2013 11:27:17 GMT

Exactly what I'm looking for! Thanks.

a212830 — Thu, 31 Jan 2013 13:14:59 GMT

I tried following the doc, and I keep getting a possible typo error. I can't find the problem.

inputs.conf:

[monitor:///usr/local/nsmutils/varlog/ncosyslog.log]
disabled = false
followTail = 0
index= throwaway
sourcetype = euc_syslogdata

[source::/usr/local/nsmutils/varlog/ncosyslog.log]
TRANSFORMS-set=setnull,setparsing

transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = [vc-]
DEST_KEY = queue
FORMAT = indexQueue

okrabbe_splunk — Thu, 31 Jan 2013 13:59:32 GMT

Is the [source] stanza actually inputs.conf or did you put it in props.conf?

a212830 — Thu, 31 Jan 2013 14:03:33 GMT

Never mind - brain fart! All set.