https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17229#M2402 <P>Hi Paolo, did you ever solve this problem? If not, since you are collecting this data via a scripted input, why not add the lookup capability on the user_name field in the same script? The script could either augment _raw with the user_role, or only write events for roles are you interested in. The 2nd option saves Splunk the trouble of having to apply index-time filtering altogether and maybe some CPU cycles.</P> Mon, 28 Mar 2011 13:54:32 GMT hulahoop 2011-03-28T13:54:32Z https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17226#M2399 <P>Hi, is it possible to route events to nullQueue based on the value found in a field generated by a csv lookup?</P> <P>I am facing a SAP audit sequential file which:</P> <OL> <LI>(on a LWF) is read through a scripted input, which also splits it in lines;</LI> <LI>has field extraction based on field position and length;</LI> <LI>field "user_name" is used to lookup a csv file which provides the field "user_role".</LI> </OL> <P>I'd need to only index log lines which have a particular value of user_role, but since that value is not present in _raw, I am not able to write the REGEX in the transforms.conf stanza.</P> <P>Any idea would be greatly appreciated, thanks</P> Mon, 12 Jul 2010 23:42:04 GMT https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17226#M2399 Paolo_Prigione 2010-07-12T23:42:04Z https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17227#M2400 <P>Sorry Paolo, I don't think it's possible. According to <A href="http://www.splunk.com/base/Documentation/latest/Admin/Indextimeversussearchtime" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Indextimeversussearchtime</A> lookups are applied at search time, not index time. The nullQueue routing would have to occur at index time in order to be effective.</P> Tue, 13 Jul 2010 02:07:47 GMT https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17227#M2400 dwaddle 2010-07-13T02:07:47Z https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17228#M2401 <P>Thank you Dwaddle; I actually knew it but was hoping on some creative ways to direct inputs to the parsingQueue and then to the nullQueue prior to indexing.</P> Tue, 13 Jul 2010 14:13:57 GMT https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17228#M2401 Paolo_Prigione 2010-07-13T14:13:57Z https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17229#M2402 <P>Hi Paolo, did you ever solve this problem? If not, since you are collecting this data via a scripted input, why not add the lookup capability on the user_name field in the same script? The script could either augment _raw with the user_role, or only write events for roles are you interested in. The 2nd option saves Splunk the trouble of having to apply index-time filtering altogether and maybe some CPU cycles.</P> Mon, 28 Mar 2011 13:54:32 GMT https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17229#M2402 hulahoop 2011-03-28T13:54:32Z https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17230#M2403 <P>Thanks for the suggestion. At the time I didn't have the skills to set that up. I had solved the problem at search time: the volume was not that bad.</P> Mon, 28 Mar 2011 19:07:15 GMT https://community.splunk.com/t5/Splunk-Search/Routing-to-nullQueue-based-on-extracted-field/m-p/17230#M2403 Paolo_Prigione 2011-03-28T19:07:15Z