How do i index only specific lines from my log file?

Ashwini008 — Wed, 17 Mar 2021 10:21:35 GMT

Hi,

I have the log file,i need to search the part of line in bold(which as only EmployeeServices/com) and index only that whole line in my index?

How do i write regex to capture only the lines in bold?please help me with props.conf and transform.con

Re: How do i index only specific lines from my log file?

gcusello — Wed, 17 Mar 2021 08:31:15 GMT

one quick question: is each row a separate event or a part of an event that contains all the rows?

If each row is an event, you can discard the other rows following the steps at https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest, in few words, you have to configure your props.conf and tranforms.conf on your Indexers or (if present) Heavy Forwarders adding the following rows in an App:

in props.conf

[your_sourcetype] TRANSFORMS-set= setnull,setparsing

in transforms.conf

[setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = EmployeeServices\/com\) DEST_KEY = queue FORMAT = indexQueue

Ciao.

Giuseppe