topic Drop specific event in Getting Data In

Drop specific event

Norling80 — Fri, 09 Oct 2015 11:43:00 GMT

I have a log that we are indexing, now we want to drop specific events from it by sending it to the nullQueue. if an event contains any of the following it should be dropped:

Redirecting the request
Redirecting the call
at

any idea what the transforms/props.conf need to look like?

Re: Drop specific event

rphillips_splk — Fri, 09 Oct 2015 13:30:57 GMT

On your indexers

props.conf
[source::.../opt/splunkforwarder/customerlogs/syslog/filter.log]
TRANSFORMS-null = setnull

transforms.conf
[setnull]
REGEX = (Redirecting the request|Redirecting the call at)
DEST_KEY = queue
FORMAT = nullQueue

If you are sending the events to a heavy forwarder before sending them to your indexers, these props & transforms will need to live on your heavy forwarder and not the indexers.

you can also use a sourcetype or host stanza in props.conf instead of source::

Re: Drop specific event

Norling80 — Mon, 12 Oct 2015 13:45:37 GMT

Works great, thanks!