topic Re: splunk discard specific events in Splunk Search

splunk discard specific events

pdash — Sat, 04 Jan 2014 00:07:15 GMT

{[-] EventInfo : {[+]}, EventType : "INFO", Properties : {[+]}, TimeStamp : "2014-01-03T19:31:30.3319998Z" }

How do i discard events that have EventType = INFO?

Currently my transforms and props are:

(transforms)

[treessvcignore] 
REGEX = \"EventType\"\:\"INFO\" 
DEST_KEY = queue 
FORMAT = nullQueue

(props)

[host::TREESSVC*] 
TRANSFORMS-null = treessvcignore

This data is in json format

The raw data looks like this
The raw event is

{"EventType":"INFO","TimeStamp":"2014-01-03T06:59:59.9645694Z","Properties":{"StackId":"PER_RNK","applicationClass":"CollatorApplication","name":"PersonRank","type":"Collator","serverClassType":"Live","serverClassApplication":"Multi","ComponentId":"PersonRank","ClientId":"Unknown","ClassName":"CollatorHandlers","MethodName":"Query","ClientPath":"Unknown","RequestPath":"a61a2538-9ef6-4c2c-8579-0d6e073c4159","Metric":...

Re: splunk discard specific events

dwaddle — Sat, 04 Jan 2014 16:59:38 GMT

I tested your configuation on my test system with your example event, and it seems to have filtered the event just fine. So I believe your configuration is (fundamentally) correct. Some questions:

Where is this configuration defined? On a forwarder, or the indexer? With Light or Universal forwarders, this configuration needs to be installed at the indexer. If there is a heavy forwarder in your environment, it needs to be at the first heavy forwarder that will touch the event.
Have you restarted Splunk since applying this change?
Are these configs in an app or in the $SPLUNK_HOME/etc/system/local directory?
Have you checked with the btool command to make sure your config is not being overridden by some other app? ( http://blogs.splunk.com/2012/10/02/tips-and-tricks-for-the-new-guy/ )

Re: splunk discard specific events

lguinn2 — Sat, 04 Jan 2014 18:21:33 GMT

dwaddle 's answer is great, but I think I see some typos in your REGEX, based on the sample event. I would do it this way

REGEX = "EventType"\s*:\s*"INFO"

ah - I didn't see the quotes at first in the raw data.

Re: splunk discard specific events

pdash — Sat, 04 Jan 2014 18:44:31 GMT

Thanks. So its on indexer not on forwarder. And within splunkhome/etc/system/local dir. Also i restarted to make the changes effective

Re: splunk discard specific events

pdash — Sun, 05 Jan 2014 23:44:25 GMT

Doesnot work either. It still shows up newly indexed data that have info in eventtype