topic Re: How can I filter out HTTP 301 and 302 on a linux Heavy forwarder so that it doesn't forward those logs to the cloud indexer in Getting Data In

How can I filter out HTTP 301 and 302 on a linux Heavy forwarder so that it doesn't forward those logs to the cloud indexer

eosi — Thu, 21 Jul 2016 10:00:55 GMT

I am new to Splunk and can see previous post for filtering out Security logs. Please would anyone be able to help with filtering out certain HTTP traffic?

Re: How can I filter out HTTP 301 and 302 on a linux Heavy forwarder so that it doesn't forward those logs to the cloud indexer

woodcock — Thu, 21 Jul 2016 14:43:41 GMT

Read up on the basic tenchique here (it is pretty strightforward):

http://docs.splunk.com/Documentation/Splunk/6.1.5/Forwarding/Routeandfilterdatad

Re: How can I filter out HTTP 301 and 302 on a linux Heavy forwarder so that it doesn't forward those logs to the cloud indexer

inventsekar — Fri, 22 Jul 2016 07:00:26 GMT

from the document, To discard specific events and keep the rest
This example discards all sshd events in /var/log/messages by sending them to nullQueue:

In props.conf, set the TRANSFORMS-null attribute:

[source::/var/log/messages]
TRANSFORMS-null= setnull
2. Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":

[setnull]
REGEX = [sshd]
DEST_KEY = queue
FORMAT = nullQueue
That does it.

could you please update us the http error log and few 301 and 302 sample messages

Re: How can I filter out HTTP 301 and 302 on a linux Heavy forwarder so that it doesn't forward those logs to the cloud indexer

michael_sleep — Fri, 22 Jul 2016 18:55:54 GMT

Post some sample data and we can give you some working regex to go with it.