topic Why isn't this data indexing? in Getting Data In

Why isn't this data indexing?

danillopavan — Wed, 06 Dec 2017 19:45:55 GMT

Hello all,

I am trying to filter the data to be indexed however not success. Nothing is indexed.

I have the below log file:

< 2017-12-06 16:25:44.569 Script: Session started.
< 2017-12-06 16:25:44.569 Executing user defined command on command session.
> 2017-12-06 16:25:44.569 [Shell] df -gt /amb/local/sap_sd ; echo "WinSCP: this is end-of-file:$?"
< 2017-12-06 16:25:44.569 Script: Filesystem    GB blocks      Used      Free %Used Mounted on
< 2017-12-06 16:25:44.569 [Shell] Filesystem    GB blocks      Used      Free %Used Mounted on
< 2017-12-06 16:25:44.569 Script: /dev/lvsapsd       9.00      5.21      3.79   58% /amb/local/sap_sd
< 2017-12-06 16:25:44.569 [Shell] /dev/lvsapsd       9.00      5.21      3.79   58% /amb/local/sap_sd
< 2017-12-06 16:25:44.569 [Shell] WinSCP: this is end-of-file:0
> 2017-12-06 16:25:44.569 [Shell] pwd ; echo "WinSCP: this is end-of-file:$?"

And i just would like to index the lines that containing the word "lvsapsd " (4th and 5th lines).

I have configured my props.conf and transforms.conf as below:

[sourcetype]
TRANSFORMS-set= setnull,setparsing

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = .*(\blvsapsd\b).*/g
DEST_KEY = queue
FORMAT = indexQueue

Re: Why isn't this data indexing?

somesoni2 — Wed, 06 Dec 2017 20:07:25 GMT

Change your transforms.conf entry for setparsing with this (your don't have to match the whole line, specific keywords that can uniquely identify your events to keep will be sufficient)

[setparsing]
 REGEX = lvsapsd
 DEST_KEY = queue
 FORMAT = indexQueue

Re: Why isn't this data indexing?

danillopavan — Wed, 06 Dec 2017 20:19:23 GMT

Perfect!! Many thanks!!! 🙂

Re: Why isn't this data indexing?

danillopavan — Sat, 09 Dec 2017 14:46:51 GMT

Just another question...if I would like to include a phrase to be matched like "Script: Filesystem", how I can use in the regex expression?

REGEX = "Script: Filesystem" ?