topic Re: NullQ output to a File? in Getting Data In

NullQ output to a File?

meenal901 — Mon, 27 Oct 2014 04:55:29 GMT

Hi,

I have applied NullQ and IndexQ filtering on my log files at Heavy Forwarder. But the client demands, we do not want to throw away the data but also don't want to index it. For sanity testing, is it possible to send the nullQ output to a flat file which will be stored on a per-day basis?

i.e. instead of writing nullqueue in the transforms, can I write name of file or location?
DEST_KEY = queue
FORMAT = nullQueue

Re: NullQ output to a File?

Ayn — Mon, 27 Oct 2014 08:36:34 GMT

Sadly no. There is no "write to file" processor.

Re: NullQ output to a File?

meenal901 — Thu, 13 Nov 2014 08:42:36 GMT

Can this be possible:

I route the unwanted data to DEST_KEY=SYSLOG, localhost:541
Then by using SYSLOGNG monitor the 541 port and redirect to a flat file instead of another Splunk instance?

Thanks,
Meenal