topic Re: How to filter few lines from an event in splunk in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-filter-few-lines-from-an-event-in-splunk/m-p/461020#M79571 <P>My transforms.conf is:</P> <P>[Dequeue]<BR /> REGEX = (?m)^(.*Dequeue.*)<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> Thu, 12 Dec 2019 13:52:30 GMT poddraj 2019-12-12T13:52:30Z How to filter few lines from an event in splunk https://community.splunk.com/t5/Getting-Data-In/How-to-filter-few-lines-from-an-event-in-splunk/m-p/461019#M79570 <P>Hi all,<BR /> I am new to splunk and am facing issue while trying to filter lines which has "Dequeue" in the event. I want the lines with Dequeue to be removed from the event before indexing. Below is my transforms.conf which is moving the entire event into nullQueue instead to remove only that line which has Dequeue in it.</P> <PRE><CODE>[Dequeue] REGEX = (?m)^(.*Dequeue.*) DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>Sample Event:</P> <PRE><CODE>|HEM FTTP TEST DTI_EXPRESS 10-118-224-197.ebiz.verizon.com VOICE 2019-11-27T10:32:00Z Y Y Y 1 5.0 YES 76000001 /CTLHDR /REQUEST VOICE YES GETCSD CHELLPA M M 8454255242 YYYYNYYYNNYYYYYNNNYNNNNYNNNYNNYYYYYYYNYYYYYYYYYYYYYYNNNNYNYYYYYYYYYYYYYYYYYYYYYY Y /REQUEST /DELPHI_REQUEST 11/28 14:36:16.75 ft_acce(19692)874 QueueCommand: DTE_KEY: SID:A391000000-, WPID:76000001, COMMAND:GET-CSD2, FT:INVALID_FT, REQID:391000000, PRIORITY:Default, TIMEOUT:1 sec 11/28 14:36:16.75 priorit(19692)497 Dequeue: Entry </CODE></PRE> Thu, 12 Dec 2019 13:51:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-few-lines-from-an-event-in-splunk/m-p/461019#M79570 poddraj 2019-12-12T13:51:26Z Re: How to filter few lines from an event in splunk https://community.splunk.com/t5/Getting-Data-In/How-to-filter-few-lines-from-an-event-in-splunk/m-p/461020#M79571 <P>My transforms.conf is:</P> <P>[Dequeue]<BR /> REGEX = (?m)^(.*Dequeue.*)<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> Thu, 12 Dec 2019 13:52:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-few-lines-from-an-event-in-splunk/m-p/461020#M79571 poddraj 2019-12-12T13:52:30Z Re: How to filter few lines from an event in splunk https://community.splunk.com/t5/Getting-Data-In/How-to-filter-few-lines-from-an-event-in-splunk/m-p/461021#M79572 <P>You are using the wrong approach. Use this instead:</P> <PRE><CODE>SEDCMD-dequeue = s/(?m)^(.*Dequeue.*)//g </CODE></PRE> Fri, 13 Dec 2019 11:50:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-few-lines-from-an-event-in-splunk/m-p/461021#M79572 woodcock 2019-12-13T11:50:52Z