topic Filtering of events using nullQueue in Getting Data In

Filtering of events using nullQueue

flucman — Fri, 15 Nov 2013 23:07:21 GMT

I am having issues filtering data into nullQueue. I have a log where the only lines I want indexed have the string "logit". I found on several sites a solution but the below still lets other strings through as well.

props.conf

[]
SHOULD_LINEMERGE = false
TRANSFORMS-set = setnull,setparsing

transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = logit
DEST_KEY = queue
FORMAT = indexQueue

is there something else that needs added?

Re: Filtering of events using nullQueue

kristian_kolb — Sat, 16 Nov 2013 10:00:55 GMT

From the look of it, it seems correct.

Are you making the configuration in the correct place? See http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

Re: Filtering of events using nullQueue

kristian_kolb — Sun, 17 Nov 2013 10:44:50 GMT

btw - you don't have the string <sourcetype> in the props.conf stanza header, do you?

That is meant to be replaced with actual sourcetype for which you want to perform nullQueueing, e.g. [access_combined] or [linux_secure].

Re: Filtering of events using nullQueue

flucman — Mon, 18 Nov 2013 15:14:54 GMT

I am updating the props.conf and transforms.conf on the indexers and search head. The location I updated was the etc/system/local files.

It seems to be working now so may have just missed refreshing the configs on an indexer. Thanks!