topic Need help filtering at the indexer in Getting Data In

Need help filtering at the indexer

pipegrep — Mon, 28 Sep 2020 19:53:44 GMT

We have a service account that populates /var/log/messages on many systems with 3 lines of text every 5 minutes. I'd like to filter that out.

These entries come in on a single source: /var/log/messages
...and a single source type: syslog

We have 4 indexers that are fed by 12 universal forwarders (in turn fed by many other Windows and linux hosts).

I'm using a deployment server to successfully deploy props.conf and transforms.conf to each of the indexers.

This is my entry in props.conf;

[syslog]
TRANSFORMS-set = setnull

This is my entry in transfro

[setnull]
REGEX = svc_scomlinux
DEST_KEY = queue
FORMAT = nullQueue

I expect any entries coming in on the source/sourcetype and containing the text svc_scomlinux to be discarded, but it's still coming through.

I spent a good part of the day reading answers here, docs and other sources on the web but I'm not getting any traction. What am I missing?

Thanks

Re: Need help filtering at the indexer

woodcock — Tue, 19 May 2015 15:30:28 GMT

This looks correct to me, unless you have misspelled transforms.conf or something silly like that. Are you getting any errors when you start Splunk saying that it cannot find setnull? You should use btool to check out what configurations are actually in place.

Re: Need help filtering at the indexer

pipegrep — Thu, 21 May 2015 13:45:09 GMT

It indeed was something silly. Ultimately I found that my search heads were actually running heavy forwarders and were outside of my deployment changes, subsequently spewing out the events. Thanks.