https://community.splunk.com/t5/Getting-Data-In/Setting-up-props-conf-and-transforms-conf-log-filtering-in/m-p/335731#M62075 <P>I apologize if this is a very obvious question, but I'm completely lost.</P> <P>A project I am working on is to filter the logs coming in so they are never indexed in the first place. Using a question here, I was able to make these props.conf and tranforms.conf files:</P> <PRE><CODE>#props [sourcetype] TRANSFORMS-set=setnull,setparsing #transforms [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = regex_to_match_at_front_(code1|code2|code3) DSET_KEY = queue FORMAT = indexQueue </CODE></PRE> <P>Here is the question I got this from:<BR /> <A href="http://how-to-configure-propsconf-and-transformsconf-to-s-1.html">https://answers.splunk.com/answers/185495/how-to-configure-propsconf-and-transformsconf-to-s-1.html</A></P> <P>Now I need to test this. Sonce I have to do this via Splunk Web, I'm trying to set up these options in a new sourcetype, via the advanced options. I know I can set up a sourcetype to properly parse the events, but whenever I some of the code as new settings, Splunk automatically deletes them (as with TRANSFORMS-set=setnull,setparsing) or replaces them (I obviously cannot have two REGEX). Basically, is it even possible to set this up in Splunk Web? If so, can you link me to the relevant documentation. I don't have access to the backend, so I need to decide how to proceed.</P> <P>Thank you.</P> <P>P.S. If anyone has another way of whitelisting events, I'd like to hear about it.</P> Thu, 27 Jul 2017 20:03:31 GMT Svill321 2017-07-27T20:03:31Z https://community.splunk.com/t5/Getting-Data-In/Setting-up-props-conf-and-transforms-conf-log-filtering-in/m-p/335731#M62075 <P>I apologize if this is a very obvious question, but I'm completely lost.</P> <P>A project I am working on is to filter the logs coming in so they are never indexed in the first place. Using a question here, I was able to make these props.conf and tranforms.conf files:</P> <PRE><CODE>#props [sourcetype] TRANSFORMS-set=setnull,setparsing #transforms [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = regex_to_match_at_front_(code1|code2|code3) DSET_KEY = queue FORMAT = indexQueue </CODE></PRE> <P>Here is the question I got this from:<BR /> <A href="http://how-to-configure-propsconf-and-transformsconf-to-s-1.html">https://answers.splunk.com/answers/185495/how-to-configure-propsconf-and-transformsconf-to-s-1.html</A></P> <P>Now I need to test this. Sonce I have to do this via Splunk Web, I'm trying to set up these options in a new sourcetype, via the advanced options. I know I can set up a sourcetype to properly parse the events, but whenever I some of the code as new settings, Splunk automatically deletes them (as with TRANSFORMS-set=setnull,setparsing) or replaces them (I obviously cannot have two REGEX). Basically, is it even possible to set this up in Splunk Web? If so, can you link me to the relevant documentation. I don't have access to the backend, so I need to decide how to proceed.</P> <P>Thank you.</P> <P>P.S. If anyone has another way of whitelisting events, I'd like to hear about it.</P> Thu, 27 Jul 2017 20:03:31 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-up-props-conf-and-transforms-conf-log-filtering-in/m-p/335731#M62075 Svill321 2017-07-27T20:03:31Z https://community.splunk.com/t5/Getting-Data-In/Setting-up-props-conf-and-transforms-conf-log-filtering-in/m-p/335732#M62076 <P>These are advanced options which are not available from Web UI. You would need to setup these up using conf file updates.</P> Thu, 27 Jul 2017 21:07:57 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-up-props-conf-and-transforms-conf-log-filtering-in/m-p/335732#M62076 somesoni2 2017-07-27T21:07:57Z