topic Re: Skip indexing one line in Splunk Search

Skip indexing one line

Glace — Fri, 04 Sep 2020 08:14:26 GMT

Hello,

im trying to skip one line while indexing whole file.

This is the line im trying to skip.

Trace Opening D:/nlog-all-2020-09-04.log with allowFileSharedWriting=False

It changes time stamp as u can see in title of the file.

How can i achieve it easiest way please?

Re: Skip indexing one line

Nisha18789 — Fri, 04 Sep 2020 08:33:47 GMT

Hi @Glace , could you please advise whether this line is one event or its part of an event when you are trying to ingest the log file in Splunk?

Re: Skip indexing one line

to4kawa — Fri, 04 Sep 2020 08:59:44 GMT

props.conf

SEDCMD-trim=s/Trace Opening.*//

SHOULD_LINEMERGE=false

Re: Skip indexing one line

Glace — Fri, 04 Sep 2020 10:25:36 GMT

Still dont work. Maybe because that line starts with date + time? Is that possible?

All lines in that file starts with date + time but only the trace opening one is unwanted.

Re: Skip indexing one line

to4kawa — Fri, 04 Sep 2020 10:54:04 GMT

now, I can't verify REGEX.please fix it.

I just recommend that try SEDCMD to delete extra line.

Re: Skip indexing one line

Glace — Mon, 07 Sep 2020 07:19:14 GMT

Hi @Nisha18789. This is one event.

Re: Skip indexing one line

isoutamo — Mon, 07 Sep 2020 15:28:32 GMT

Hi
It's easier to help you, if you post real sample which whole line instead of tell partially what it contains.
r. Ismo