topic Re: Getting rid of unwanted events in Getting Data In

Getting rid of unwanted events

ssjabid — Tue, 29 Sep 2020 22:26:17 GMT

Hi, I am trying to get rid of 2 events from a XML file I am trying to ingest,
I am editing the transforms.conf to send 2 events to the null queue,
the 2 events I am trying to get off are the and (an example of the XML file is below)

-80.33100097073213,25.10742916222947
Interdiction
23
Ironwood
2013-04-24
00:07:00

0
-80.23429525620114,24.08680387475695
Rustic

so my transform is able to get rid of the tag but I cannot get rid of the tag

my props.conf for this sourcetype looks like

[dreamcrusher]
DATETIME_CONFIG =
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
category = Custom
pulldown_type = 1
BREAK_ONLY_BEFORE =
LINE_BREAKER =
TRUNCATE = 5000
disabled = false
TRANSFORMS-datarootnull = DATAROOTNULL
MUST_BREAK_AFTER =

and my transforms.conf for this transform looks like

[2DATAROOTNULL]
REGEX = <.*?dataroot>
DEST_KEY = queue
FORMAT = nullQueue

any help would be greatly appreciated!
Thanks

Re: Getting rid of unwanted events

whrg — Wed, 19 Dec 2018 18:02:54 GMT

It looks like some text is not displayed properly.
Can you use the "Code Sample" function instead?

Re: Getting rid of unwanted events

ssjabid — Thu, 20 Dec 2018 13:25:33 GMT

its all good dude, managed to get there in the end

Re: Getting rid of unwanted events

FrankVl — Thu, 20 Dec 2018 14:41:03 GMT

Then please post your solution as an answer and mark that as accepted, such that it is clear that this question is resolved 🙂

Re: Getting rid of unwanted events

ssjabid — Thu, 20 Dec 2018 14:45:46 GMT

got the answer, i had to make a sedcmd command in the props 🙂

Re: Getting rid of unwanted events

ssjabid — Thu, 20 Dec 2018 14:57:54 GMT

had to use sedcmd command in the props.conf file, all good