topic How to filter out data after specific event? in Getting Data In

How to filter out data after specific event?

haph — Wed, 13 Mar 2019 16:55:24 GMT

Hi,

I'm trying to filter out data after a specific event occurs.

I want to drop all of the search data to display in a timechart, after a this specific event.
The event (and all other data) is in the shape
{ "name": "NAME", "value": "VALUE" }

If the value from name=specific_name changes from 0 to 1 I want to drop all data after this change.

How can I do that?

If you need more information please ask! 🙂

Thanks!

Re: How to filter out data after specific event?

somesoni2 — Wed, 13 Mar 2019 18:43:21 GMT

More information plz. Assuming this NOT filtering of events from being ingested but rather doing a search time filter in your search. Please provide details about how your data looks (may be real data), what you're getting now and what you expect.

Re: How to filter out data after specific event?

sbattista09 — Thu, 04 Apr 2019 03:00:14 GMT

i think this answer may help, its should be a quick props.conf and transforms.conf setting, we do this to filter out huge debug logs and other things application owners cant adjust on there side.

https://answers.splunk.com/answers/223818/how-to-write-the-regex-in-transformsconf-to-filter.html