https://community.splunk.com/t5/Getting-Data-In/Index-only-rows-that-match-a-pattern/m-p/437066#M94656 <P>i have a file with following pattern : SERVICESTATE::CRITICAL , which updates everyday.<BR /> this file also has many other rows which does not have the above pattern.<BR /> i would like to only index the rows that match this pattern.<BR /> could i get help on how this can be done...</P> <P>thanks,<BR /> john.</P> Tue, 05 Jun 2018 20:14:08 GMT jiaqya 2018-06-05T20:14:08Z https://community.splunk.com/t5/Getting-Data-In/Index-only-rows-that-match-a-pattern/m-p/437066#M94656 <P>i have a file with following pattern : SERVICESTATE::CRITICAL , which updates everyday.<BR /> this file also has many other rows which does not have the above pattern.<BR /> i would like to only index the rows that match this pattern.<BR /> could i get help on how this can be done...</P> <P>thanks,<BR /> john.</P> Tue, 05 Jun 2018 20:14:08 GMT https://community.splunk.com/t5/Getting-Data-In/Index-only-rows-that-match-a-pattern/m-p/437066#M94656 jiaqya 2018-06-05T20:14:08Z https://community.splunk.com/t5/Getting-Data-In/Index-only-rows-that-match-a-pattern/m-p/437067#M94657 <P>You believe you want to do - "Keep specific events and discard the rest". So follow instruction from below link and use appropriate REGEX for your pattern.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest">http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest</A></P> Tue, 05 Jun 2018 21:36:42 GMT https://community.splunk.com/t5/Getting-Data-In/Index-only-rows-that-match-a-pattern/m-p/437067#M94657 somesoni2 2018-06-05T21:36:42Z