topic Re: Filter data by props.conf and transform.conf in Getting Data In

Filter data by props.conf and transform.conf

marco_massari11 — Fri, 16 Apr 2021 09:37:07 GMT

Hi,

I need to filter out some events from a syslog source. All the events that I need to exclude are like this:

Apr 16 11:24:23 ********** 2021-04-16T11:24:23.604+02:00 *************************************** - Modified Query: START TRANSACTION

Can anyone could help?

Thanks in advance

Re: Filter data by props.conf and transform.conf

aasabatini — Fri, 16 Apr 2021 10:00:03 GMT

Hi @marco_massari11

props.conf

[source::"your source"] TRANSFORMS-filter = eventsDrop

transforms.conf

[eventsDrop] REGEX = START\sTRANSACTION DEST_KEY = queue FORMAT = nullQueue

to help you better I would need the source and sourcetype info

Regards

Alessandro

Re: Filter data by props.conf and transform.conf

marco_massari11 — Fri, 16 Apr 2021 10:19:18 GMT

Hi @aasabatini ,

my sourcetype is sourcetype=syslog.

So it should be:

[syslog]
TRANSFORMS-filter = eventsDrop

[eventsDrop]
REGEX = START\sTRANSACTION
DEST_KEY = queue
FORMAT = nullQueue

Is it correct?

Regards

Marco

Re: Filter data by props.conf and transform.conf

aasabatini — Fri, 16 Apr 2021 10:31:29 GMT

Yes @marco_massari11 , it's correct
props.conf

[syslog] TRANSFORMS-filter = eventsDrop

transforms.conf

[eventsDrop] REGEX = START\sTRANSACTION DEST_KEY = queue FORMAT = nullQueue

Confirmation solution or karma given is appreciated

Alessandro

Re: Filter data by props.conf and transform.conf

marco_massari11 — Fri, 16 Apr 2021 10:50:35 GMT

Hi @aasabatini ,

it seems not working. In my props I have already a:

[syslog]
TRANSFORMS-null= **** It exclude an IP in trasnsform.conf.

So I need to do like this?:

[syslog]
TRANSFORMS-null= ****
TRANSFORMS-filter = eventsDrop

Re: Filter data by props.conf and transform.conf

aasabatini — Fri, 16 Apr 2021 11:00:07 GMT

Hi @marco_massari11

no, you need to put your transformations stanza, separated by comma

example:

[syslog] TRANSFORMS-null= ****,eventsDrop

consider the possibility to filter only data as you need with regex.

Re: Filter data by props.conf and transform.conf

marco_massari11 — Fri, 16 Apr 2021 11:09:10 GMT

Hi @aasabatini ,

this is my inputs.conf, I don't know if it could help:

[udp://****]
connection_host = ip
index = ***
source = ***
sourcetype = syslog

Re: Filter data by props.conf and transform.conf

marco_massari11 — Fri, 16 Apr 2021 11:29:59 GMT

Hi @aasabatini ,

my app hasn't the flag on Restart Splunkd. So now it should be work