https://community.splunk.com/t5/Splunk-Search/Read-regex-based-data-from-a-log-file-using-splunk-forwarder/m-p/542707#M153726 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232160">@raunakomar</a>&nbsp;</P><P>Search the community for nullQueue. You'll find many examples similar to this:</P><P># props.conf<BR />[foo]<BR />TRANSFORMS-sendToNullQueue = sendToNullQueue</P><P># transforms.conf<BR />[sendToNullQueue]<BR />REGEX = no new data found<BR />DEST_KEY = queue<BR />FORMAT = nullQueue</P><P>Your REGEX value should contain a regular expression matching the events you want to exclude.</P><P>See also&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest" target="_self">https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest</A>.</P> Sat, 06 Mar 2021 22:22:11 GMT tscroggins 2021-03-06T22:22:11Z https://community.splunk.com/t5/Splunk-Search/Read-regex-based-data-from-a-log-file-using-splunk-forwarder/m-p/542531#M153685 <P>I have log file which polls an endpoint and if new version has come then only performs the operation. All the polling (whether new version is available or not ) are logged into log file. I am trying to read this log file which is working fine. But I want to avoid redundant polling logs and send only those logs where new version was found. Can this be done on splunk forwarder using input.conf file?</P> Fri, 05 Mar 2021 10:40:35 GMT https://community.splunk.com/t5/Splunk-Search/Read-regex-based-data-from-a-log-file-using-splunk-forwarder/m-p/542531#M153685 raunakomar 2021-03-05T10:40:35Z https://community.splunk.com/t5/Splunk-Search/Read-regex-based-data-from-a-log-file-using-splunk-forwarder/m-p/542707#M153726 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232160">@raunakomar</a>&nbsp;</P><P>Search the community for nullQueue. You'll find many examples similar to this:</P><P># props.conf<BR />[foo]<BR />TRANSFORMS-sendToNullQueue = sendToNullQueue</P><P># transforms.conf<BR />[sendToNullQueue]<BR />REGEX = no new data found<BR />DEST_KEY = queue<BR />FORMAT = nullQueue</P><P>Your REGEX value should contain a regular expression matching the events you want to exclude.</P><P>See also&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest" target="_self">https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest</A>.</P> Sat, 06 Mar 2021 22:22:11 GMT https://community.splunk.com/t5/Splunk-Search/Read-regex-based-data-from-a-log-file-using-splunk-forwarder/m-p/542707#M153726 tscroggins 2021-03-06T22:22:11Z