How to keep only the first 5 lines of a multi-line event?

garypark — Tue, 26 Aug 2014 23:41:41 GMT

In my logs I have a lot of java errors that are about 100 lines long. I would like to filter the event at the universal forwarder and keep only the first 5 lines. I would like single line events to be unaffected.

I have the following settings, but they don't seem to be working for me.

In inputs.conf

[monitor:///app/tmp/test-GP/test*] sourcetype = test-GP index = test-gp disabled = 0 whitelist = .log$

In props.conf

[test-GP] TRANSFORMS-shortenEvents = keepOnly5Lines

In transforms.conf

[keepOnly5Lines] REGEX = (?m)^(.*\n){1,5} FORMAT = $1 DEST_KEY = _raw

Re: How to keep only the first 5 lines of a multi-line event?

somesoni2 — Wed, 27 Aug 2014 02:37:15 GMT

Try this for your transforms.conf (keeping everything else same, your current config just keeps first 5 line in the file and remove all other entries)

[keepOnly5Lines] 
REGEX = (?m)^((.*\n){5})((.*\n)*)
FORMAT = $1
DEST_KEY = _raw

topic How to keep only the first 5 lines of a multi-line event? in Splunk Search

How to keep only the first 5 lines of a multi-line event?

Re: How to keep only the first 5 lines of a multi-line event?