topic Re: How to exclude string from being indexed? in Getting Data In

How to exclude string from being indexed?

mmsbswe — Tue, 25 Jun 2019 13:45:01 GMT

Hello community,

i want to configure the splunk forwarder to exclude one specific string from being indexed to the splunk index.

In my case i want to exclude all lines like this from being transferred to the indexer:

*[25-Jun-2019 15:31:29 Europe/Berlin] PHP Deprecated:  The "checkDataSubmission" hook will be removed...*

These are my config files:

File: **/opt/splunkforwarder/etc/system/local/inputs.conf**

...
[monitor:///var/log/docker/php-fpm/error.log]
sourcetype=php:fpm:error
crcSalt=
index=php


File: **/opt/splunkforwarder/etc/system/local/props.conf**

[source::/var/log/docker/php-fpm/error.log]
TRANSFORMS-null= setnull


File: **/opt/splunkforwarder/etc/system/local/transforms.conf **

[setnull]
REGEX = .*PHP Deprecated.*
DEST_KEY = queue
FORMAT = nullQueue

I've done the following steps to debug this by myself:
executed:

- *./splunk cmd btool props list --debug*
- *./splunk cmd btool transforms list --debug*

To check if my configuration files was loaded when restarting the splunk service. All my configured lines are displayed by this.

Also i've restarted the splunk forwarder after editing the config.

Every help will be appreciated.

Re: How to exclude string from being indexed?

amitm05 — Tue, 25 Jun 2019 16:09:37 GMT

@mmsbswe
Looks like you are trying to do this on the Univ forwarder itself. These would not apply on UF.
You'd require to take these settings of props.conf and transforms.conf onto your indexer.

Thanks!

Re: How to exclude string from being indexed?

amitm05 — Wed, 26 Jun 2019 20:02:30 GMT

Have you tried this? Let us know.
You can also mention if you have already sorted this out OR Accept this one if it worked. It'll help others. Thanks

Re: How to exclude string from being indexed?

mmsbswe — Thu, 27 Jun 2019 14:04:57 GMT

Thanks for your reply.

Correct, i do this on the universial forwarder. It seems that i have to try it on our indexer.

Edit: Now it works :-).

Re: How to exclude string from being indexed?

amitm05 — Thu, 27 Jun 2019 17:30:19 GMT

Glad that it worked out. Cheers !